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PREFACE 


This  study  is  a  review  of  current  methods  for  estimating  the  vulner¬ 
ability  of  systems  within  the  Earth’s  atmosphere  to  the  electro¬ 
magnetic  pulse  (EMP)  formed  by  nuclear  explosions  at  high  altitudes# 
above  the  atmosphere.  The  Defense  Nuclear  Agency,  U.  S.  Department  of 
Defense,  requested  the  review  from  the  National  Research  Council.  The 
request  stemmed  from  concern  over  reliability  of  estimates  of  the 
degree  of  protection  offered  by  different  engineering  approaches  and, 
in  particular,  over  the  U3e  of  statistics  in  making  such  estimates. 

The  request  did  not  embrace  any  other  nuclear  explosion  effects. 
Accordingly,  the  study  committee,  formed  by  the  Energy  Engineering 
Board  of  the  Commission  on  Engineering  and  Technical  Systems,  has  left 
the  relative  significance  of  EMP  to  other  analyses. 

As  a  useful  context  for  its  work,  the  committee  first  obtained  an 
overview  of  the  high-altitude  EMP  problem  and  of  the  uncertainties 
involved,  focusing  on  vulnerability  assessment  methodologies.  The 
high-altitude  EMP  problem  is  impressively  complicated,  with  many 
connected  parts.  Each  part  is  complex  in  itself  and  requires 
substantial  effort  in  computational  codes:  the  mechanism  of 
electromagnetic  pulse  generation,  "coupling"  of  the  pulse  field  with 
structures  to  induce  currents  and  voltages  within  systems — not  always 
linearly,  susceptibilities  of  a  subsystem  to  failure  by  damage  to  its 
components  and  by  upset  caused  by  internal  currents  and  voltages,  and 
methods  of  combining  uncertainties  to  form  probabilistic  estimates  of 
overall  system  survival  during  its  mission  in  an  electromagnetic  pulse 
environment. 

After  this  overview  the  committee  received  information  from  the 
Department  of  Defense  and  its  contractors  in  areas  directly  relevant 
to  its  task.  The  committee  also  heard  individuals  from  non-defense 
qroups,  such  as  American  Telephone  and  Telegraph  Company,  the  Energy 
Research  Advisory  Board  of  the  U.  S.  Department  of  Energy,  and  the 
Nuclear  Regulatory  Commission,  which  are  also  concerned  with  the  EMP 
vulnerability  problem. 

The  committee  had  access  to  classified  information  but  it  did  not 
receive  complete  results  of  actual  weapons-system  tests  or 


assessments.  Nevertheless,  I  believe  the  committee  obtained  an  appre¬ 
ciation  of  current  methodologies  of  system  vulnerability  assessments 
adequate  to  reach  firm  conclusions  about  the  state  of  the  art  of  the 
statistics  involved  and  to  comment  on  the  engineering  approaches  to 
protection  against  high  altitude  EMP.  By  focussing  on  methodologies, 
rather  than  results,  the  committee  has  been  able  to  produce  an 
unclassified  report. 

Taken  as  a  whole,  I  believe  the  report  addresses  most  of  the 
sponsor's  concerns,  as  posed  in  the  form  of  questions  intended  to 
guide  the  committee's  work.  Rather  than  prescribe  the  manner  of 
implementation  of  the  recoirmendations,  details  are  purposely  left  to 
the  program  managers  of  the  EMP  community. 

Because  EMP  vulnerability  assessment  and  protection  are  such  spe¬ 
cialized  topics,  the  audience  contemplated  for  the  report  is  primarily 
the  sponsor  and  those  immediately  concerned  with  technical  aspects  of 
the  problem.  Hence  considerable  background  is  assumed,  and  the  report 
omits  a  comprehensive  survey  for  the  general  reader  of  the  many 
elements  of  the  overall  problem. 

The  committee  is  grateful  to  Gordon  K.  Soper,  of  the  Defense 
Nuclear  Agency,  for  his  support,  encouragement,  and  perspective  on  the 
task.  Others  in  that  agency,  notably  Col.  William  B-.  Adams,  Bronius 
Cikotas,  and  Lt.  Col.  Robert  B.  Williams,  supplied  much  information 
and  made  many  arrangements  for  briefings,  visits,  and  security.  Our 
thanks  also  go  to  the  individuals  and  organizations  that  provided  the 
many  briefings  listed  in  Appendix  B.  Special  thanks  are  due  to  John 
W.  Tukey,  of  Princeton  University,  who,  in  the  course  of  his  review  of 
the  report  manuscript,  offered  the  section  in  Chapter  4  giving  guid¬ 
ance  on  different  kinds  of  statistics.  Finally,  I  wish  to  acknowledge 
the  assistance  rendered  by  the  staff  of  the  Energy  Engineering  Board. 
Dennis  F.  Miller,  Executive  Director,  was  largely  responsible  for 
launching  this  project  and  for  providing  important  assistance  during 
its  course.  John  M.  Richardson  served  as  study  director.  1 
appreciate  as  well  the  ready  help  of  Sidney  G.  Reed  Jr.,  Helen  D. 
Johnson,  and  Cheryl  A.  Woodward,  of  the  board  and  committee  staffs. 


John  R.  Pierce,  Chairman 
Committee  on  Electromagnetic 
Pulse  Environment 
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EXECUTIVE  SUMMARY 


High-altitude  electromagnetic  pulse  (BMP)  is  an  electromagnetic 
radiation  of  very  short  rise  time,  large  amplitude,  and  brief  duration 
that  follows  a  nuclear  explosion  above  the  atmosphere.  The  area  over 
which  a  single  EMP  event  is  experienced  can  be  very  great  if  the 
explosion  if  high  enough  and  large  enough.  Several  such  nuclear 
explosions  might  render  unprotected  electronic  equipment  and  systems 
inoperative  over  an  area  as  large  as  the  continental  United  states. 
Damage  may  occur  when  high  currents  and  voltages,  driven  by  EMP,  reach 


vital  Internal  circuits.  It  is  therefore  essential  to  protect  the 
systems  and  to  form  some  idea  of  how  well  they  will  withstand  EMP. 


/\ 


OVERVIEW 


The  Committee  on  Electromagnetic  Pulse  Environment  was  formed  in  late 
1982  to  advise  the  Defense  Nuclear  Agency  on  estimating  vulnerability 
to  Q4P.  In  the  committee's  charge  there  was  a  strong  emphasis  on  the 
assessment  of  vulnerability  to  high-altitude  EMP  and  on  statistics  as 
a  method  of  assessment.  Attention  was  also  to  be  given  to  techniques 
of  protection,  testing,  and  engineering  analysis  as  they  bear  on 
assessment  of  vulnerability. 

Both  the  design  and  the  assessment  of  protection  against  EMP  are 
inherently  subject  to  uncertainty.  The  reason  is  that  these  processes 
must  be  conducted  without  exposure  to  actual  EMP,  in  contrast  to  the 
situation  for  other  forms  of  electrical  overstress. 

Estimating  vulnerability  of  systems  to  electromagnetic  pulse 
effects  depends  greatly  on  the  nature  of  the  system.  The  soundest 
results  can  be  obtained  where  stress  within  the  system  is  controlled, 
through  integral  shielding  and  penetration-control  devices,  to  well 
known  values.  In  this  case,  one  can  rely  on  engineering  analysis  and 
systematic  testing  of  a  predominantly  deterministic  nature.  Where 
control  and  knowledge  of  stress,  as  well  as  of  strength,  are  not 
possible  because  of  system  design,  complexity,  or  uncontrolled 
changes,  probabilistic  estimates  become  necessary.  Statistical 
methods  for  estimating  and  combining  uncertainties,  fault  tree 
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analysis,  and  Bayesian  inference  may  be  used  to  systematize  the 
estimates  of  vulnerability.  However,  repeated  testing  of  systems,  and 
subsystems,  at  as  high  a  simulated  threat  level  as  possible,  is 
essential  with  this  approach.  Whatever  method  is  used,  the 
uncertainty  of  the  result  should  be  clearly  emphasized  to  decision 
makers  lest  oversimplification  result. 


CONCLUSIONS 

One  crucial  conclusion  cuts  across  the  whole  EMP  protection  program: 
adequate  testing  is  the  appropriate  means  for  assessment.  Adequate 
testing,  in  turn,  rests  on  two  foundations.  The  first  is  engineering 
design  that  produces  units  amenable  to  meaningful  tests.  The  second 
is  the  use  of  statistics  to  collect,  analyze,  interpret,  and  present 
the  test  data,  together  with  the  associated  uncertainties,  with 
clarity. 


Engineering  Aspects 

On  the  engineering  side,  assessability  should  be  an  important  design 
criterion.  It  is  imperative  to  utilize  a  deuign  strategy  that  is 
testable  to  a  high  degree  of  assurance  and,  preferably,  that  can  be 
monitored  for  continued  effectiveness  during  the  actual  operation  of 
the  equipment.  Some  designs  are  much  more  easily  assessable  than 
others. 

For  example,  shielding  is  a  fairly  simple  and  sure  approach  to  EMP 
protection.  If  the  system  is  shielded  so  well  that  the  internal 
fields  produced  by  EMP  are  at  the  level  of  system  noise,  periodic 
tests  of  the  integrity  of  the  shielding  and  tests  at  high  level  by 
applying  pulses  individually  to  all  leads  entering  the  shielded 
enclosure  can  constitute  an  adequate  test.  Thus,  assessment  is  made 
much  more  practical  by  integral  shielding  around  a  whole  system  (3uch 
as  a  system  housed  in  a  building  on  the  ground).  Alternatively, 
subsystems  of  the  system  may  be  put  into  very  well  shielded  boxes; 
and,  except  for  power,  antenna,  and  a  few  other  properly  filtered 
leads,  all  (signal)  interconnections  may  be  made  by  the  rapidly 
developing  technology  of  fiber  optics,  which  cannot  conduct  EMP  into 
the  boxes.  Antennas,  by  their  very  nature,  roust  be  exposed  to  EMP; 
thus  their  lead-in  transmission  lines  require  specialized  protective 
measures. 

"Tailored  hardening,"  the  major  alternative  to  shielding  for  EMP 
protection,  carries  with  it  more  risk  of  vulnerability.  In  this 
approach  selected  subsystems  and  components  are  protected  against 
high-level  fields.  In  this  case,  to  assess  resistance,  or  "hardness," 
to  EMP  effects,  the  entire  system  (perhaps  a  whole  aircraft)  must  be 
tested  at  threat  level  initially.  The  purpose  of  testing  after 
shielding  or  hardening  is  just  as  much  to  detect  unsuspected  faults  in 
the  shielding  or  hardening  process  as  it  is  to  see  whether  the 


analytic  predictions  are  correct.  The  system  may  likewise  require 
retesting  after  mcdif ication  or  replacement  cf  parts.  For  systems 
with  tailored  hardening,  difficulty  in  making  accurate  analytic 
predictions  of  their  response  to  such  high-level  testing  has  served  to 
limit  credence  in  the  estimation  of  response  to  an  actual  EMP  event. 
For  thete  reasons  the  committee  is  uncomfortable  with  the  use  of 
tailored  hardening  to  design  new  systems.  Nevertheless,  the  methods 
of  tailored  hardening  can  be  useful  for  improving  the  protection  of 
large,  existing  systems. 

The  committee  emphasizes  the  difficulty  of  adequately  assessing 
unhardened  systems  and  systems  with  tailored  hardening.  Even  given  a 
positive  assessment,  in  cur  present  state  of  knowledge  such  systems 
may  or  may  not  be  hard.  One  should  distinguish  demonstrated  hardness 
from,  as  noted  in  Chapter  4,  "semiquantitative  statements  or... a  'warm 
or  cold  feeling'  about  the  hardness  of  the  system. “ 

In  assessing  hardness  against  EMP,  it  is  necessary  to  assess  the 
hardness  of  only  those  systems  essential  to  the  completion  of  the 
mission.  Thus,  it  is  important  to  identify  the  essential  systems. 

Not  only  must  these  essential  systems  be  hard,  but  also  inter¬ 
connections  among  them  must  be  hard. 

We  also  observe  that  the  final  word  has  not  been  spoken  on  the 
nature  of  the  threat  and  the  optimum  protection  against  it. 


Statistical  Aspects 

On  the  statistics  side,  the  findings  of  the  statisticians,  who  worked 
as  a  panel,  were  crucial  to  the  conclusions  of  the  committee  as  a 
whole.  With  minor  exceptions,  the  statisticians  found  deficiencies 
and  evidence  of  lack  of  expertise  and  confusion  of  issues  in  the 
statistical  work  that  was  presented  to  them.  Some  of  this  confusion 
has  found  its  way  into  contract  performance  specifications.  Beyond 
what  has  been  ccraaonly  employed  so  far,  an  appreciable  number  of 
available  and  emerging  statistical  techniques,  including  fault  tree 
analysis,  can  be  usefully  applied  to  portions  of  the  EMP  problem. 
Advanced  training  and  educational  opportunities  would  help  inject  such 
expertise  into  the  EMP  field. 

The  potential  role  of  statistics  in  EMP  protection  and  assessment 
is  not  merely  central,  but  is  essential  and  inevitable  at  several 
levels  of  the  EMP  problem.  Statistics  can  aid  engineers  in  their 
efforts  to  design  hardened  and  testable  units.  Statistics  is  well 
suited  to  characterize  certain  properties  of  large  populations  of 
piece  parts  and  the  quality  control  of  shielding.  Statistics  can 
improve  the  design  of  tests  and  the  evaluation  of  results  at  both  the 
subsystem  and  system  level.  For  huge  systems  that  cannot  be  tested  as 
a  whole,  there  is  little  other  recourse  than  statistical  inference 
from  incomplete  information.  Certain  statistical  methods  provide  a 
framework  for  compounding  performance  estimates  for  portions  of  the 
system  into  performance  estimates  for  the  whole  system. 


When  a  quite  uncertain  number  is  the  best  that  can  be  had,  it  may 
be  important  to  get  it  and  important  not  to  throw  it  away — but  even 
more  Important  not  to  take  it  too  seriously. 

And  finally,  since  there  is  no  way  to  base  an  analytical  estimate 
of  EHP  vulnerability  on  first  principles,  there  can  be  no  substitute 
for  the  best  physical  simulations  possible  as  a  route  to  adjust  and 
improve  the  results  of  analytical  studies. 


RECOMMEND AT I OHS 

Our  recommendations  concerning  the  achievement,  through  engineering 
design,  of  assessable  military  systems  protected  against  EMP  follow 
from  the  conclusions  outlined  above.  These  recommendations  are 
excerpted  here  for  reference: 

o  There  should  be  a  continued  reappraisal  of  the  threat,  its 

consequences,  and  the  best  near-term  practices  and  longer-term 
research  needed  for  meeting  it. 

o  Adequate  analyses  should  be  made  of  what  systems,  subsystems, 
and  support  systems  are  essential  to  completion  of  mission, 
o  There  should  be  great  emphasis  on  achieving  assessability  by 
promptly  developing  better  and  cheaper  means  for  virtually 
complete  and  effective  shielding  of  systems  essential  to  the 
completion  of  mission.  This  objective  should  include  a  strung 
emphasis  on  early  use  of  standardized  shielded  boxes 
interconnected  with  optical  fibers, 
o  There  should  be  a  program  to  study  and  devise  and  evaluate  the 
best  and  most  economical  way  for  continual  testing  to  assure 
the  maintenance  of  hardness. 

o  There  should  be  a  better  understanding  of  the  mechanisms  of 
component  failure  and  better  and  more  insightful  component 
tests  and  interpretation  of  test  data, 
o  There  should  be  increased  emphasis  on  thoroughgoing  analysis, 
testing,  and  comparison  of  analysis  with  test  at  the  level  of 
functional  circuit  aggregations,  or  "boxes." 
o  A  long-range  program  should  be  initiated  and  directed  toward 
the  systematic  validation  of  prediction  methods.  The  TRESTLE 
and  comparable  high-level  simulators  constitute  a  promising 
avenue  to  that  end.  These  simulators  generate  pulses  that  are 
similar  in  many  ways  to,  but  also  significantly  different  from, 
the  expected  EMP  event.  Important  insights  into  the 
credibility  of  prediction  methods  themselves  could  be  obtained 
by  employing  these  methods  to  predict  the  response  of 
components  and  systems  to  the  fields  known  to  be  produced  by 
the  simulators  and  by  confirming  those  predictions  with 
experiments  using  the  simulators. 
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Our  recommendations  concerning  statistics  and  statisticians  also 
flow  from  the  conclusions  that  are  summarized  above.  These 
recommendations,  likewise,  are  listed  here  for  reference: 

o  The  EMP  community,  including  its  management,  should  be  better 
educated  on  the  key  ideas  and  procedures  of  statistics  and 
reliability.  Improved  standardization  of  statistical 
terminology  used  by  the  EMP  community  should  be  pursued  in 
order  to  reduce  confusion  with  respect  to  its  interpretation 
and  uses. 

o  The  government  should  utilize  qualified  and  experienced 

personnel,  well  trained  in  statistics,  to  oversee  contractors* 
bids  and  work  that  involve  statistics. 

o  Collaboration  among  statisticians,  engineers,  and  physicists 
working  in  the  field  of  EMP  protection  and  assessment  should  be 
encouraged.  The  statisticians  on  such  teams  should  be  well 
versed  in  the  latest  techniques  and  developments  in  statistical 
methodologies  and  reliability. 

o  Contractual  specifications  that  may  be  interpreted  to  require 
survival  with  probability  equal  to  one  (that  is,  certainty) 
should  be  avoided.  Such  specifications  can  lead  to 
misunderstanding  and  legal  problems,  as  well  as  to  a  poor 
choice  of  contractors.  We  recommend,  rather,  a  collection  of 
tests  such  that  passing  all  will  be  acceptable  as  satisfaction 
of  EMP  requirements. 

o  Because  fault  tree  analysis  is  a  useful  management  tool,  it 
should  be  utilized  in  EMP  work  where  it  is  applicable.  Both 
empirical  and  theoretical  work  may  be  required  to  tailor  fault 
trees  to  the  particular  needs  of  the  EMP  problem. 

o  The  Defense  Nuclear  Agency  should  establish  a  number  of 

postdoctoral  fellowships  closely  integrated  with  the  field  of 
EMP  protection  and  assessment.  The  fellowships  could  be 
administered  so  as  to  encourage  interdisciplinary 
collaboration,  attract  new  talent  to  the  field,  and  supplement 
the  ongoing  programs. 


INlft-flUCTION 


High-altitude  electromagnetic  pulse  (EM?)  is  an  electromagnetic 
radiation  of  very  short  rise  time,  large  amplitude,  and  brief  duration 
that  follows  a  nuclear  explosion  above  the  atmosphere.  The  area  over 
which  a  single  EKP  event  is  experienced  can  be  very  great  if  the 
explosion  is  high  enough  and  large  enough.  Several  such  nuclear 
explosions  might  render  unprotected  electronic  equipment  and  systems 
within  the  atmosphere  inoperative  over  an  area  as  large  as  the 
continental  United  States.  Other  electromagnetic  disturbances,  such 
as  lightning,  occur;  but  none  constitute  the  extensive  threat  of  EMP. 


THE  TASK 

Accordingly,  estimation  of  vulnerability  to  EMP  effects  is  essential 
for  strategic  and  tactical  decisions  affecting  national  security. 

Such  estimates  are  usually  made  using  a  combination  of  methods  most 
appropriate  to  the  case  at  hand.  Predictive  calculations  of  EMP 
stresses  are  made.  Breakdown  thresholds  of  electronic  components  are 
measured.  Preliminary  system  vulnerability  estimates  are  put 
together.  Protective  measures  are  engineered.  Small-scale  tests  and 
large-scale  simulations  may  be  conducted.  The  cycle  of  analysis, 
protection,  and  test  may  continue  until  responsible  Individuals  are 
satisfied  with  the  vulnerability  estimate.  The  outstanding  problems, 
however,  are  that  data  are  sparse  and  great  uncertainties  attach  to 
the  entire  process  of  estimation  and  protection.  Thus  one  appeals  to 
statistical  methods  to  make  the  most  of  the  data.  Even  more  important 
is  the  characterization  of  the  uncertainty  in  the  resulting 
vulnerability  estimate,  since  the  usefulness  of  the  estimate  depends 
crucially  on  its  validity. 

The  Committee  on  Electromagnetic  Pulse  Environment  was  formed  in 
late  1982  to  evaluate  methodologies  commonly  used  for  estimating 
vulnerability  to  EMP  effects  for  the  Defense  Nuclear  Agency  (DNA) .  At 
the  first  meeting  of  the  committee  on  February  2,  1983,  Dr.  Gordon  X. 
Soper,  then  Acting  Deputy  Director  for  Science  and  Technology  of  DNA, 
gave  a  far-ranging  overview  of  EMP  problems  and  issues.  He  also 
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presented  six  questions,  given  in  Appendix  A,  as  a  guide  to  the 
committee's  work,  while  these  questions  raised  issues  regarding  the 
efficiency  and  assessability  of  various  methods  of  protection, 
especially  "tailored  hardening"  versus  "integral  shielding  with 
protected  penetration  controls,"  there  was  a  repeated  emphasis  on  the 
usefulness  and  appropriateness  of  statistical  measures  such  as 
"probability  of  survival"  and  "confidence." 

The  chief  role  of  the  committee,  as  distilled  from  its  statement  of 
task  (Appendix  A)  and  from  Dr.  Soper's  briefing,  was  to  give  the 
sponsor  sound  advice  on  practical  methods  for  assessing  military 
systems  and  subsystems  for  effective  operation  af~er  exposure  to  BMP, 
taking  into  account  the  analysis,  testing,  and  protective  techniques 
that  may  be  employed. 
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THE  APPROACH 

The  committee  was  constituted  to  deal  expertly  with  matters  of  both  a 
statistical  and  an  engineering  nature.  Of  the  total  committee 
membership  of  ten,  five  members  were  statisticians  or  mathematicians 
with  a  statistical  background.  One  was  a  systems  analyst  with 
expertise  in  the  statistical  aspects  of  simulation.  Four  were 
electrical  engineers.  In  the  committee's  work,  the  statisticians 
acted  as  a  panel  in  dealing  with  essentially  statistical  problems. 

The  committee  was  given  a  large  amount  of  information  about  various 
issues  relevant  to  DNA's  concern  with  BMP,  such  as  testing  procedures 
and  protective  measures.  These  matters  are  addressed  in  some  detail 
later  in  this  report.  Other  issues  include  the  nature  of  the  threat, 
countermeasures,  and  the  question  of  who  shoald  oversee  the  validity 
of  work  and  methods.  There  is  also  a  substantial  number  of  issues 
concerned  with  non-military  systems  and  products  on  which  the  military 
depends,  including  the  civilian  communications  and  power  networks  and 
such  common  items  a3  automobiles  and  hand  calculators.  The  committee 
received  briefings  concerning  these  issues;  and  material  from  some  of 
the  briefings  is  reflected  in  this  report,  chiefly  in  Chapter  2,  which 
provides  a  background  for  the  committee's  work.  Much  of  what  the 
committee  heard  provided  a  useful  context  for  its  chief  task. 

Presentations  at  committee  meetings  are  listed  in  Appendix  B. 

These  topics  included  the  overall  high-altitude  BMP  problem,  magnitude 
of  the  BMP  effect,  estimation  of  currents  and  voltages  due  to  BMP,  and 
the  role  of  thresholds  for  failure.  The  topics  also  covered  different 
engineering  approaches  to  protection,  examples  of  vulnerability 
assessment  methodology,  and  suggested  programs  for  improvement  of 
probabilistic  estimates,  including  the  use  of  Bayesian  approaches  to 
uncertainty.  Visits  to  several  test  facilities  were  made.  Assessment 
methodology  was  the  dominant  topic.  The  committee  heard,  in  all,  five 
briefings  on  aircraft  vulnerability  assessment,  one  presentation  on  a 
major  strategic  missile,  and  two  descriptions  of  ground  command  and 


control  stations.  The  statistics  group  held  several  sessions  of  their 
own.  One,  in  New  York,  dealt  with  estimation  of  probability  of 
survival  and  codes  for  calculating  system  responses  to  EMP.  Another, 
in  Albuquerque,  covered  efforts  to  obtain  and  analyze  data  on 
component  failure. 

The  chapters  that  follow,  ar.d  the  related  appendixes,  reflect  the 
structure  of  the  EMP  vulnerability  assessment  problem.  Thus  Chapter  2 
outlines  the  physical  mechanism  of  generation  of  high-altitude  EMP. 

The  chapter  also  gives  a  brief  account  of  actual  observations  of  EMP 
and  its  effects  produced  by  the  U.S.  high-altitude  nuclear  tests  in 
the  early  1960s.  Appreciation  of  the  magnitude  and  other 
characteristics  of  high-altitude  EMP  occurred  about  the  time  when 
progress  in  electronics  began  to  lead  to  widespread  use  of 
semiconductor  components.  Such  components  are  generally  more 
vulnerable  than  the  components  they  replaced.  Chapter  2,  together 
with  Appendix  C,  notes  also  that  considerable  uncertainty  exists  in 
estimates  of  voltages  and  currents  within  complex  systems  because  of 
interaction  of  the  electromagnetic  pulse  fields  with  these  systems. 
Chapter  3,  along  with  Appendix  D,  deals  with  the  protection  of  systems 
whose  vulnerability  to  high-altitude  EMP  is  to  be  estimated.  That 
chapter  outlines  what  are  believed  to  be  sound  engineering  principles 
and  practices.  The  chapter  also  discusses  pros  and  cons  of  two 
approaches  to  protection  that  emphasize,  respectively,  shielding  and 
selective,  or  ’tailored,’  hardening.  Chapter  4,  mainly  the 
contribution  of  the  statistics  panel,  discusses  the  application  of 
statistics  to  the  estimation  of  vulnerability  of  systems  to  high- 
altitude  EMP.  (Appendixes  E  through  G  give  further  details.) 

Finally,  Chapter  5  contains  conclusions  and  recommendations. 


THREAT  AND  HISTORY 


The  threat  presented  by  electromagnetic  pulse  (EMP)  is  an  extraor¬ 
dinary  one  in  at  least  four  ways  compared  to  other  electromagnetic 
disturbances.  EMP  is  of  very  large  magnitude;  it  occurs  over  a  large 
area;  its  onset  is  extremely  fast;  and  it  is  of  brief  duration.  These 
characteristics  in  combination  create  a  serious  problem  of  vulnera¬ 
bility  for  electronic  systems.  This  chapter  cites  some  early 
observations  of  EMP  effects,  qualitatively  describes  the  generation  of 
the  EMP  phenomena  itself,  comments  upon  the  vulnerability  of  various 
kinds  of  systems,  and  briefly  compares  EMP  to  other  electromagnetic 
threats. 


EARLY  OBSERVATIONS 

While  some  aspects  of  EMP  were  understood  before  the  termination  of 
all  but  underground  tests  in  1963,  the  large  magnitude  of  the  EMP  from 
explosions  above  the  atmosphere  was  not  correctly  predicted  until 
afterwards.  Strong  EMP  effects  were  first  noticed  in  July  of  1962, 
during  the  FISHBOWL  sequence  of  high-altitude  nuclear  tests. 

STARFISH,  a  detonation  over  Johnson  Atoll,  800  miles  southwest  of 
Hawaii,  caused  a  minor  disruption  of  street-light  power  on  Oahu  and 
set  off  numerous  burglar  alarms.  Telephone  service  was  not 
interrupted  as  a  result  of  this  detonation.  However,  this  fact  does 
not  necessarily  mean  that  the  telephone  network  is  immune  to  EMP 
threats  that  may  occur  under  current  or  foreseeable  conditions. 

Three  other  tests  later  in  1962 — CHECKMATE,  BLUEGILL,  and 
KINGPISH — were  instrumented  (though  imperfectly,  for  lack  of  full 
understanding  of  the  phenomenon)  for  studying  the  electromagnetic 
fields  at  ground  level  following  detonation.  Some  data  on  the 
magnitude  of  the  EMP  were  obtained  during  these  tests.  These  data  are 
consistent  with  the  currently  accepted  theory,  first  described  by 
Longmire  (1964),  and  later  elaborated  by  him  and  by  others  (Longmire, 
1978;  Karzas  and  Latter,  1965;  Crain,  1982). 
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THE  GENERATION  OF  ELECTROMAGNETIC  PULSE 


Main  Features 

The  main  features  of  EMP  may  be  appreciated  from  a  few  qualitative 
considerations.  The  underlying  cause  of  EMP  is  gamma  radiation, 
created  extremely  rapidly  by  a  nuclear  explosion  and  lasting  only 
briefly.  The  fast  onset  of  EMP  and  its  brief  duration  are  related  in 
part  to  these  characteristics  of  the  gamma  radiation.  The  large 
terrestrial  area  over  which  EMP  will  occur  results  from  the  fact  that 
a  high-altitude  burst  will  irradiate  the  Earth’s  atmosphere,  within 
which  the  pulse  is  generated,  out  to  a  very  distant  horizon.  The 
large  magnitude  of  EMP  at  all  points  within  the  atmosphere  within  line 
of  sight  of  the  explosion  and  the  related  sharp  onset  of  EMP  occur  for 
two  reasons.  First,  the  gamma  radiation  and  the  newly  developing 
pul re  are  both  traveling  outward  with  the  same  speed — the  speed  of 
lignt.  Thus  later  contributions  to  the  pulse  from  the  action  of  the 
gamma  radiation  coincide  with,  and  add  directly  to,  the  pulse  already 
formed.  Secondly,  electrons  produced  by  the  gamma  radiation  are  the 
direct  sources  of  the  pulse  mainly  because  of  their  spiral  motion  in 
the  Earth's  magnetic  field;  these  electrons  also  travel  outward  with 
nearly  the  speed  of  light;  thus  the  later  contribution  to  the 
outward-t raveling  pulse  from  a  given  electron  nearly  coincides  with, 
and  adds  to,  its  prior  contributions,  actually  generating  a  more 
sharply  rising  pulse  than  would  otherwise  occur.  The  magnitude  of 
EMP,  even  from  very  powerful  nuclear  devices,  reaches  a  limit  set  by 
electrical  conductivity  in  the  atmosphere,  also  caused  by  the  nuclear 
explosion. 


Greater  Detail 

For  those  interested  in  greater  detail,  the  generation  of  EMP  is 
described  more  fully  in  the  following  paragraphs. 

A  nuclear  explosion  in  space  produces  an  intense  pulse  of  gamma 
rays  with  a  rise  time  of  the  order  of  a  few  nanoseconds  and  a  decay 
time  of  a  few  tens  of  nanoseconds.  After  emission  from  the  nuclear 
explosion  these  prompt  gammas  travel  in  a  spherical  shell  with 
thickness  of  a  few  meters  and  with  radius  that  increases  at  the  speed 
of  light. 

The  downward-t raveling  part  of  this  shell  begins  to  interact 
appreciably  with  the  atmosphere  at  altitudes  of  40  kilometers  (km)  to 
50  km.  The  gammas,  in  traveling  through  the  air,  produce  a  flux  of 
Compton  recoil  electrons,  which  constitutes  an  electron  current 
density  with  a  rise  time  approximately  similar  to  that  of  the  gamma 
rays.  At  about  30  kra  altitude,  the  gammas  have  passed  through  a  mass 
of  air  equivalent  to  one  absorption  length,  the  absorption  length 
being  approximately  equal  to  an  atmospheric  scale  height  of  about 
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7  km.  At  the  altitude  of  about  30  km  the  generation  of  Compton  recoil 
electrons  is  at  a  maximum,  since  for  higher  altitudes  there  is  less 
air  density  with  which  to  interact  and  at  lower  altitudes  the  gammas 
have  been  mostly  absorbed. 

The  Compton  electrons  are  deflected  from  their  predominantly  radial 
path  from  the  burst  by  the  Earth's  magnetic  field.  (The  radius  of 
curvature  of  the  deflected  motion  is  on  the  order  of  meters.)  As  a 
result  of  the  rotation  of  the  electrons  by  the  magnetic  field,  a 
component  of  the  Compton  current  is  generated  transverse  to  the  radial 
direction  from  the  explosion.  Although  other  components  of  current 
are  present,  it  is  the  transverse  current  and  the  outgoing  EM  signal 
radiated  by  it  that  result  in  the  large  EM  pulse  that  is  observed  in 
the  radial  direction  from  - he  explosion. 

Since  the  gamma  rays  move  outward  from  the  burst  at  the  speed  of 
light,  the  Compton  current  pulse  also  appears  to  do  so.  This 
traveling-pulse  feature  of  the  Compton  current  has  an  important  effect 
on  both  the  amplitude  and  rise  time  of  the  EM  pulse  that  is  observed. 
EM  signals  generated  at  different  distances  from  the  explosion,  and 
therefore  at  different  times,  tend  to  arrive  simultaneously  at  a 
distant  observer  along  the  same  ray  path.  The  amplitude  is  thereby 
reinforced  and  the  rise  time  is  shortened. 

Each  of  the  Compton  electrons  originates  with  energy  of  about  1 
million  electron  volts  (MeV)  and  generates  on  the  order  of  30,000 
secondary  electron- ion  pairs  along  its  track  in  the  air.  These 
secondary  electrons  do  not  contribute  to  the  electromagnetic  (EM) 
field  generation  mechanism,  but  they  do  constitute  a  conducting  region 
that  serves  to  limit  the  peak  value  of  the  EM  field  generated  by  the 
high-energy  (1-MeV)  electrons. 

The  most  used  method  (Longmire,  1978;  Karzas  and  Latter,  1965)  for 
calculating  the  radiated  EM  field  results  from  combining  the  individ¬ 
ual  Compton  electron  motions  to  determine  a  time-  and  space-dependent 
current  density,  from  which  the  radiation  field  is  calculated  as  a 
solution  of  the  Maxwell  equations.  An  alternative  solution  (Crain, 
1982)  can  be  obtained  by  summing  the  radiation  from  the  individual 
Compton  electrons  in  a  three-dimensional  volume.  When  correctly 
carried  out  both  methods  give  essentially  the  same  results.  Peak 
field  strengths  within  a  factor  of  two  greater  or  less  than  30 
kilovolts  per  meter  are  obtained  from  the  calculations.  The  pulse 
rise  times  are  on  the  order  of  a  few  nanoseconds,  resulting  in 
important  spectral  components  up  to  frequencies  on  the  order  of 
hundreds  of  megahertz. 

During  the  initial  short  rise  time  portion  of  the  EM  signal, 
coherent  radiation  occurs  from  electrons  in  a  region  extending  only  a 
few  hundred  meters  transverse  to  the  line  of  sight  from  the  observer 
to  the  explosion.  Similar  results  can  be  obtained  for  the  current- 
shell  methods  by  the  use  of  Fresnel-zone  arguments.  Thus  from  the 
point  of  view  of  a  given  observer  only  a  rather  small  region  of  the 
total  volume  illuminated  by  the  gamma  rays  will  be  crucial  to  the 
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short  rise-time  portion  of  the  EM  pulse  signal.  However,  essentially 
the  same  phenomenon  occurs  for  an  observer  anywhere  within  a  large 
area;  hence  the  widespread  coverage  of  an  EMP  event. 

To  insure  the  survival  of  military  systems  the  Defense  Nuclear 
Agency  has  developed  interim  threat  level  "EM  Pulse  Criteria" — both 
for  waveforms  in  time  and  for  the  resultant  spectra.  The  interim 
criteria  are  aimed  at  including  the  entire  package  of  EM  pulse 
characteristics  that  it  is  believed  might  reasonably  be  encountered  by 
military  systems  as  a  result  of  exposure  to  a  range  of  weapons,  from 
present  day  stockpile  devices  to  somewhat  EMP-enhanced  designs.  These 
"criteria"  waveforms  appear  to  provide  reasonable  guidance  to  system 
designers  for  system  hardening  purposes  and  test  purposes.  Some 
people,  however,  worry  that  they  may  somewhat  overestimate  the  threat 
that  would  be  encountered  under  most  circumstances.  The  committee  is 
aware  of  views  developed  by  the  Rand  Corporation  (Appendix  B,  presen¬ 
tation  by  Bedrosian,  August  9-10,  1983)  concerning  these  maximum 
threat  models  and  the  response  of  the  Defense  Nuclear  Agency  (1983) . 
These  views  do  not  affect  the  conclusions  of  the  committee  on 
evaluation  and  protection  methodologies. 

In  addition  to  EMP,  high-altitude  nuclear  explosions  generate  a 
"magnetohydrodynaroic"  pulse  of  much  longer  duration,  which  develops 
more  slowly.  This  effect  somewhat  resembles  that  due  to  severe  solar 
storms,  which  sometimes  cause  damage  in  geographically  extensive 
systems,  such  as  coaxial  cable  communications  systems  and  power 
systems.  Vulnerability  to  magnetohydrodynaraic  effects  is  not  treated 
in  this  report. 


SYSTEM  VULNERABILITY 

System  vulnerability  to  damage  depends  in  a  large  part  on  the  overall 
coupling  of  EMP,  not  only  through  deliberate  paths  into  vital  internal 
circuits  (such  as  antennas,  waveguides,  power  lines,  and  telephone 
lines)  but  also  through  unintentional  paths  (ouch  as  conductors  other 
than  signal  and  power  lines,  imperfect  shields,  and  faulty  ground 
connections).  Appendix  C  presents  a  fuller  discussion  of  coupling, 
the  methods  for  quantitatively  analyzing  it,  and  the  resulting 
uncertainties. 

After  the  mechanism  and  magnitude  of  EMP  were  understood,  a  number 
of  simulators  for  investigating  system  vulnerability  were  built  by 
federal  agencies  and  private  firms,  including  American  Telephone  and 
Telegraph  Company  and  Rockwell  International  Corporation.  Various 
devices  and  systems  have  been  subjected  to  simulated  EMP,  including 
automobiles,  walkie-talkies,  hand  calculators  (Appendix  B,  presen¬ 
tation  by  Cikotas,  April  1-2,  1983),  airplanes,  telephone  switching 
systems,  and  telephone  offices  (Appendix  B,  presentations  by 
Grimmelmann  and  by  Osifchin,  April  1-2,  1983).  Resistance  to  damage 
and  dysfunction  has  varied  widely  among  similar  small  devices  such  as 
hand  calculators,  according  to  Cikotas1  presentation. 


The  vulnerability  to  EMP  of  civilian  communications  and  power 
systems  is  difficult  to  assess;  this  vulnerability  depends  on  the  care 
and  soundness  of  engineering  design  and  protection  against  other  large 
electrical  disturbances,  including  lightning,  and  on  the  degree  to 
which  EMP  is  taken  into  account  in  designing  and  modifying  such 
systems.  For  example,  Osif chin's  presentation  stated  that  a  carefully 
built  Autovon  switching  node  showed  neither  damage  nor  serious 
degradation  of  service  during  repeated  simulated  EMPs.  Other,  less 
rugged  switching  equipment  has  been  damaged  under  similar  conditions. 

The  National  Security  Telecommunication  Advisory  Committee, 
appointed  in  1982  by  the  President  Reagan,  with  staff  support  from  the 
National  Communications  Systems,  a  unit  of  the  Defense  Communications 
Agency,  is  currently  working  toward  measures  for  reducing  the  impact 
of  EMP  and  other  nuclear  effects  on  common-carrier  communications. 

One  means  being  considered  is  that  of  reconstituting  the  network  after 
attack  by  bypassing  inoperative  portions  of  the  system  with  remaining 
links.  While  this  is  an  excellent  approach  for  dealing  with  localized 
damage  from  other  nuclear  effects,  it  may  be  less  effective  in  dealing 
with  the  widespread  damage  that  might  be  caused  by  EMP. 

The  approach  of  the  Bell  System  has  been  somewhat  different  (Bell 
Telephone  Laboratories,  Inc.,  1975;  also  Appendix  B,  presentation  by 
Osifchin,  April  1-2,  1983).  This  approach  has  been  to  minimize  the 
effects  of  EMP  by  careful  engineering  practices,  including  shielding 
where  needed,  and  to  provide  added  protective  devices  for  circuits  and 
equipment  used  by  the  government. 

We  mention  such  widespread  implications  of  EMP  because  they  are  of 
general  concern  and  interest  and  because  they  have  some  assessment  and 
protection  methodologies  in  common.  However,  we  concentrated  on 
methods  for  assessing  the  degree  of  protection  of  various  military 
systems  and  installations  essential  to  an  adequate  response  to  an 
attack  using  EMP.  Our  examination  necessarily  included  the  means  of 
protection  of  aircraft  and  missile  systems  and  radar  and  other 
detection  systems.  We  also  paid  attention  to  hardened  emergency 
communications  systems,  for  use  if  both  common-carrier  facilities  and 
common-carrier  services  fail. 


OTHER  ELECTROMAGNETIC  THREATS 

Other  than  EMP,  there  are  numerous  electromagnetic  threats,  both 
man-made  and  natural,  to  military  systems.  Such  threats  include 
internal  interference  from  other  circuits,  transient  overvoltages  and 
overcurrents  on  power  and  signal  lines,  radiating  electric  and 
magnetic  fields  from  nearby  equipment  and  systems,  electrostatic 
discharge,  and  natural  phenomena  such  as  lightning.  The  differences 
in  the  interference  sources  can  be  described  in  terms  of  (1)  the 
magnitude  and  spectral  characteristics  of  the  electric  field,  the 
magnetic  field,  and  the  conducted  voltages  and  currents  and  (2)  the 
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progagation  characteristics  of  the  wave  fronts  and  polarization  of  the 
electric  field  and  magnetic  field.  These  threats  may  be  compared 
briefly  with  EMP. 

The  uniqueness  of  EMP  is,  first,  its  rarity — we  do  not  encounter 
EMP  events  apart  from  nuclear  hostilities — and,  second,  its  temporal 
and  spectral  form.  EMP  has  a  very  short  rise  time,  a  short  time 
duration,  and  a  very  high  magnitude.  Mo  other  man-made  or  natural 
source  exactly  matches  these  characteristics.  Lightning  can  exceed 
EMP's  electromagnetic  magnitudes,  but  its  spectral  distribution  of 
power  is  less  than  that  of  EMP  above  20  megahertz  (MHz)  to  40  MHz. 
Also,  the  area  covered  by  high  electromagnetic  field  strength  is  small 
for  lightning  compared  to  that  for  EMP  (Chapter  3). 

In  addition  to  lightning,  numerous  man-made  sources,  such  as  radar 
and  "directed  energy"  weapons,  have  high  peak-power ,  pulsed  outputs. 
These  sources  do  not  generate  a  substantial  low-frequency  spectral 
distribution  of  power,  as  EMP  does;  but  their  high-frequency  spectral 
power  can  exceed  that  of  EMP  at  selected  frequencies. 

It  is  conceivable  that  a  system  supposedly  hardened  against  .EMP 
might  fail  when  exposed  to  lightning  or  to  one  of  the  man-made 
high- intensity  fields  mentioned  above.  This  breakdown  might  disclose 
some  unsuspected  weakness  in  the  protection  provided  against  BMP. 

Thus,  any  such  failures  should  be  carefully  investigated.  However, 
because  of  the  unique  temporal  and  spectral  characteristics  of  EMP,  we 
believe  that  failures  due  to  lightning  and  the  other  hazards  cited 
should  at  mo3t  be  considered  as  a  secondary  means  for  assessing 
systems  protected  against  EMP. 
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PROTECTION  AND  ASSESSABILITY 


The  possibility  of  an  adequate  assessment  of  system  hardness  against 
the  electromagnetic  pulse  (EMP)  threat  depends  on  the  nature  of  the 
system  as  well  as  on  the  assessment  method.  An  unprotected  system  of 
unknown  configuration  and  performance  requirements  is  essentially 
unassessable.  Systems  with  known  requirements  hardened  against  EMP  in 
various  ways  hove  various  degrees  of  assessability.  This  chapter 
describes  some  of  the  protective  approaches  that  must  be  assessed  both 
by  engineering  test  and  by  the  statistical  techniques  discussed  in 
Chapter  4.  One  section  points  out  the  importance  of  the  design, 
prototype,  and  deployment  phases  in  attaining  protection  against  EMP 
and  other  stresses.  Another  section  reviews  the  merits  of  various 
methods  in  common  use  tor  assessing,  by  test  and  verification,  the 
degree  of  EMP  protection  actually  attained.  Finally,  the  chapter 
compares  the  degree  of  assurance  offered  by  the  two  main  protection 
approaches,  known  as  tailored  hardening  and  shielding. 


LEVELS  OF  SEVERITY  OF  STRESS 

The  EMP  fields  couple  to  metallic  elements  of  electronic  and  power 
systems  and  produce  voltages  and  currents,  which  add  stress  to 
electronic  components  and  interfere  with  normal  voltages  and  currents 
representing  information.  We  may  consider  three  levels  of  severity, 
within  the  spectral  range  of  EMP  effects,  at  a  given  electronic 
component  terminal: 

1.  The  voltages  and  currents  caused  by  EMP  are  small  compared  to 
the  voltages  and  currents  in  the  absence  of  EMP. 

2.  The  voltages  and  currents  caused  by  EMP  are  comparable  to  the 
voltages  and  currents  in  the  absence  of  EMP,  and  the  resultant 
levels  can  produce  upsets  (Appendix  D) . 

3.  The  voltages  and  currents  caused  by  EMP  are  large  compared  to 
the  voltages  and  currents  in  the  absence  of  EMP,  and  the 
resultant  levels  can  produce  upsets  and  damage. 
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Assessment  Is  easiest  and  surest  when  systems  are  designed  so  that 
components  experience  only  the  first  severity  level.  This  design 
assures  that  effects  of  EMP,  if  any,  will  be  limited  to  disturbance  in 
a  small  number  of  electronic  circuits  with  marginal  performance  even 
in  the  absence  of  EMP. 


THE  PROTECTION  PROCESS  FOR  OTHER  STRESSES 
AND  FOR  ELECTROMAGNETIC  PULSE 

Stresses,  other  than  EMP,  in  the  form  of  undesired  voltages  and 
currents  appear  in  electronic  circuits  for  various  reasons,  including 
the  followings  interference  from  other  circuits,  transient 
(momentary)  overvoltages  and  overcurrents  produced  when  equipment 
power  is  turned  on  or  off,  stresses  caused  by  temporary  improper 
operation  by  operators,  electrostatic  discharge,  and  stresses  caused 
by  lightning.  (Lightning  has  some  of  the  characteristics  of  EMP,  as 
pointed  out  later  in  this  chapter.) 


Idealized  Protection  Process 

Normal  engineering  design  practices  take  into  account  the  possibility 
of  these  typical  stress  is  and  attempt  to  produce  designs  that  can 
survive  and  operate  under  such  stresses  with  only  occasional  isolated 
problems.  The  design  process  begins  with  a  specification  embracing 
the  type  of  environment  that  a  piece  of  equipment  must  tolerate 
without  damage  and  within  which  it  must  operate  properly.  Care  is 
taken  to  combine  experience  and  specific  information  about  the 
application  to  produce  a  specification  that  is  as  close  as  possible  to 
the  real  environment. 

Using  mathematical  analysis  and  modeling  tools,  engineers  design 
circuits  that  can  be  expected  to  meet  the  specifications.  This  design 
process  includes  the  selection  of  components  whose  ruggedness  is 
sufficient  for  the  anticipated  stresses.  Since  individual  components 
of  a  given  type  are  not  identical  when  actually  manufactured,  the 
designer  will  select  component  types  with  enough  safety  margin  to 
allow  for  manufacturing  variability.  In  some  critical  cases,  the 
designer  may  require  that  each  component  of  a  particular  type  be 
individually  tested  before  being  used  in  the  equipment. 

Having  completed  this  initial  design  process,  design  engineers  will 
arrange  for  the  production  of  prototype  versions  of  the  equipment. 

Such  prototype  equipment  will  be  tested  in  the  laboratory  under 
conditions  that  simulate  the  anticipated  real  environment  (including, 
for  example,  simulated  stresses  due  to  lightning).  However,  since  the 
prototype  equipment  contains  only  representative  samples  of 
components,  one  cannot  be  sure  that  the  results  of  this  testing  apply 
to  the  vast  majority  of  units  that  will  ultimately  be  deployed.  Also, 
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the  simulated  environment  may  not  be  totally  representative  of  the 
extremes  of  the  actual  environment. 

Any  design  deficiencies  discovered  in  the  testing  of  the  prototypes 
are  corrected,  and  a  second  round  cf  prototype  testing  proceeds.  This 
process  is  repeated  until  the  design  engineers  have  verified,  through 
testing  and  simulation,  that  the  equipment  ‘'meets  the  specifications." 

The  equipment  is  then  manufactured  and  deployed.  It  is  not 
unusual,  particularly  in  complex  equipment,  to  discover  design  defects 
after  deployment.  One  expects  some  incidence  of  random  failure  of 
isolated  pieces  of  equipment  due  to  defects  in  components  and  to 
operating  environments  that  are  more  severe  than  those  anticipated  in 
the  design  phase.  However,  some  types  of  failures,  which  occur  too 
frequently,  will  be  traced  to  design  errors..  That  is,  components 
within  the  circuitry,  although  not  defective,  are  being  stressed 
beyond  their  tolerance.  Design  errors  at  this  point  muse  be  corrected 
by  a  very  costly  process,  including  such  measures  as  modification  or 
recall  of  units  deployed  in  the  field,  modification  of  units  in 
manufacture  or  in  inventory,  and  modification  of  documentation.  This 
costly  process  is  avoided  a>  much  as  possible  by  careful  initial 
design  and  testing  before  deployment;  nevertheless,  it  typically 
occurs  in  complex  products. 


Protection  Process  Cor  Electromagnetic  Pulse 


Comparing  the  above  exemplary  protection  process  to  the  protection 
process  for  EMP,  one  notes  some  important  similarities  and  contrasts. 

EMP  is  a  producer  of  voltage  and  current  stresses,  just  as  are 
lightning  and  the  other  causes  mentioned  above.  Under  idealised 
assumptions  one  could  predict  the  stresses  produced  by  EMP  and  could 
design  circuitry  to  accommodate  those  stresses.  However,  the  stresses 
produced  by  actual  EMP  may  not  correspond  to  those  predicted  by 
analytical  methods.*  As  in  conventional  stresses,  oversights  and 
modeling  errors  could  be  uncovered  either  by  testing  or  in  the  actual 
environment.  For  EMP,  of  course,  the  opportunity  to  learn  from 
failures  in  the  deployment  phase  comes  too  late.  Since  failures 
occurring  in  the  actual  environment  might  affecc  all  systems  simul¬ 
taneously  (inasmuch  as  EMP  effects  occur  over  a  large  geographical 
area  simultaneously)  it  is  imperative  to  utilize  a  design  strategy 
tnafc  is  testable  to  a  high  degree  of  assurance  and,  preferably,  that 
can  be  monitored  for  continued  effectiveness  during  the  actual 
operation  of  the  equipment. 


*In  results  reported  to  the  committee  for  field  simulators,  predicted 
stresses  differed  from  meafured  stresses,  on  both  the  high  and  the  low 
side,  by  up  to  two  orders  of  magnitude  in  power  (Appendix  R, 
presentation  by  Van  Zandt  on  September  30-October  1,  1983). 


TESTING  AND  VERIFICATION  METHODOLOGIES 


International  agreements  prohibiting  the  testing  of  nuclear  weapons  in 
or  above  the  atmosphere  also  preclude  the  observation  of  EMP  and  its 
effects  on  real  systems.  tKii  exception  is  some  limited  extrapolation 
from  the  1962  FISHBOWL  test  series.)  Thus  it  is  important  to  review 
the  types  of  tests  that  can  be  made  to  estimate  and  verify  EMP 
protection,  both  in  the  design  process  and  in  the  maintenance  of 
hardened  systems. 


Field  Simulators 

The  effects  of  EMP  are  induced  by  the  coupling  of  the  electromagnetic 
field  caused  by  a  nuclear  event  to  metallic  structures — ultimately 
producing  harmful  currents  and  voltages  at  the  terminals  of  electronic 
components.  One  approach  for  testing  the  vulnerability  of  systems  to 
"real"  EMP  is  to  generate  fields  within  a  volume  of, space  that  have 
characteristics  similar  to  the  anticipated  fields  from  a  real  event. 
Systems  that  can  be  entirely  enclosed  within  that  volume  of  space  can 
then  be  tested.  This  approach  is  practical  for  small  systems,  which 
can  be  exposed  to  EMP  simulation  fields  in  a  correspondingly  small 
simulator.  The  fact  that  small  simulators,  which  can  produce  local 
fields  equaling  or  exceeding  the  anticipated  actual  EMP  over  a  small 
volume  of  space,  can  be  economically  constructed  gives  advantage  to 
any  protection  strategy  that  allows  large  systems  to  be  tested  as 
small  individually  hardened  modules. 

When  designing  an  EMP  simulator,  care  must  be  taken  to  account  for 
the  effects  of  reflections  from  ground  planes  (conducting  surfaces) , 
which  disturb  the  field  and  which  may  not  be  present  in  actual  system 
operation.  Care  must  be  taken  to  produce  fields  having  temporal 
characteristics  (turn-on  and  turn-off  times)  similar  to  actual  EMP. 

The  larger  the  volume  of  space  to  be  illuminated  with  artificially 
generated  fields,  the  more  costly  the  simulator  and  the  more  difficult 
it  becomes  to  simulate  real  EMP  accurately.  Additionally,  large 
simulators,  such  as  those  at  the  Air  Force  Weapon**  Laboratory  in 
Albuquerque,  are  so  cumber come  to  operate  that  only  very  limited  test 
data  can  be  acquired — typically  on  a  sample  size  of  only  one  complete 
system.  These  limitations,  while  unavoidable,  need  to  be  recognized 
in  interpreting  such  test  results. 

An  alternative  to  the  generation  of  threat-level  simulated  EMP  is 
to  generate  low-amplitude  fields  in  an  appropriate  volume  of  space. 

If  one  assumes  that  the  response  of  the  system  grows  linearly  in 
relation  to  the  field  level,  then  one  can  extrapolate  observed 
currents  and  voltages  to  threat-level.  However,  this  approach  has  two 
significant  shortcomings.  First,  the  low-level  responses  (currents 
and  voltages)  do  not  causa  failures  or  upsets.  Measured  values  of 
these  responses  lat  a  limited  number  of  test  points)  must  be 


extrapolated  to  infer  failures  or  upsets  at  threat  level,  based  on 
estimated  vulnerabilities  of  subsystems  exposed  to  those  extrapolated 
voltages  and  currents.  Second,  the  assumption  of  a  linear  system 
response  is  not  necessarily  valid  and  is  difficult  to  verify  without 
threat-level  exposure. 


Direct  Current  and  Voltage  Drive 

As  stated,  EMP  fields  may  produce  damaging  currents  and  voltages  at 
the  terminals  of  susceptible  equipment.  If  one  assumes  that  most  of 
these  effects  are  the  results  of  currents  and  voltages  induced  on 
conductors  leading  to  the  terminal  interfaces  of  electronic  modules, 
then  one  can  attempt  to  measure  vulnerability  by  reproducing 
anticipated  currents  and  voltages  at  these  terminals  with  appropriate 
signal  generators. 

The  advantage  of  this  approach  is  that  it  is  relatively  easy  to 
generate  currents  and  voltages  on  conductors  with  directly  attached 
signal  generators,  as  compared  to  inducing  these  currents  and  voltages 
with  field  simulators.  However,  in  modern  systems,  typical  electronic 
modules  have  numerous  powering  and  signal-carrying  terminal 
interfaces.  The  currents  and  voltages  presented  at  these  interfaces 
can  have  differing  amplitudes,  polarities,  and  waveforms  in  time. 
Because  of  this  fact,  one  would  have  to  know  the  exact  waveforms  that 
would  be  produced  by  EMP  on  each  terminal  and  would  have  to  reproduce 
them  all  individually. 

On  the  other  hand,  one  can  attempt  to  glean  some  insight  regarding 
the  EMP  hardness  of  a  module  by  driving  all  interfaces  simultaneously 
with  some  voltage  or  current,  estimated  to  be  at  threat  level. 

However,  it  is  not  obvious  that  such  a  test  actually  simulates  the 
true  EMP  stress.  If,  however,  the  number  of  interfaces  to  metallic 
conductors  were  reduced  (using  fiber  optics  for  signal  transportation) 
to  a  single  power  lead,  this  approach  to  EMP  stress  simulation  would 
be  more  convincing. 


Testing  for  Shielding  Integrity 

One  approach  to  EMP  protection,  which  is  more  fully  discussed  later  in 
this  chapter,  is  shielding.  In  this  method,  one  attempts  to  prevent 
harmful  fields  from  reaching  susceptible  components  by  enclosing  die 
components  in  a  metallic  shield.  Verification  that  the  shield  design 
ic  effective  is  best  done  with  full  threat-level  field  simulators  (to 
uncover  elusive  nonlinear  effects).  However,  once  the  basic  design  is 
verified,  low-level  field  generators  can  be  used  to  monitor  the  shield 
for  deterioration  (penetrations)  over  time.  In  essence,  a  ]ow-Ievel 
generator  is  placed  on  one  side  of  the  shield  (inside  or  outside)  and 


appropriate  signal  detectors  are  placed  on  the  other  side.,  this 
process  can  be  automated  for  continous  testing  where  appropriate. 

Natural  Lightning  as  a  Simulator  of  EMP 

It  has  been  proposed  that  there  are  similarities  between  the  stress 
imposed  by  natural  lightning  events  on  systems  in  operational  use  and 
the  stress  that  they  might  encounter  from  an  EMP  event.  Over  a  region 
of  space  lightning  produces  intense  electromagnetic  fields,  which  can 
couple  to  nearby  metallic  structures  3ust  as  EMP  couples  to  metallic 
structures. 

A  lightning  flash  typically  lasts  about  one-half  second  and 
consists  of  a  large  number  of  diverse  processes,  each  of  which 
generates  an  electromagnetic  signal  (Oetzel  and  Pierce,  1969).  Since 
the  lightning  channel  is  a  line  source  (at  least  for  the  large 
ground-return  stroke) ,  as  contrasted  with  the  two-dimensional  EMP 
source,  the  field  strength  decreases  rapidly  with  increasing  distance 
from  the  stroke.  When  one  scales  observed  lightning  field  strengths 
to  short  distances  (on  the  order  of  50  meters)  to  obtain  higher 
fields,  the  field  strength  of  lightning  is  more  severe  than  that  of 
nuclear  EMP  below  1  MHz.  However,  since  the  rise  time  of  EMP  is  only 
a  few  nanoseconds  compared  to  a  few  microseconds  for  the  relatively 
slower  rise  time  of  lightning,  the  EMP  environment  is  more  severe  than 
that  of  lightning  in  the  region  above  1  MHz.  Furthermore,  the 
coupling  of  fields  in  the  environment  around  a  system  like  an  aircraft 
to  components  within  the  system  is  strongly  enhanced  by  the  electrical 
resonances  of  the  system.  A  typical  aircraft  fuselage  resonates  in 
the  range  of  frequencies  between  1  MHz  and  10  MHz.  Internal  wiring 
resonances  are  typically  above  20  MHz.  Thus  the  relatively  low- 
frequency  lightning  fields  will  couple  relatively  little  energy  into 
the  internal  components  of  an  airplane,  while  the  relatively 
high-frequency  EMP  fields  will  couple  relatively  large  amounts  of 
energy  to  internal  components. 

Compounding  these  significant  differences  between  lightning  and 
nuclear  EMP  are  undertamties  regarding  the  true  characteristics  of 
lightning  at  close  range.  Scaling  of  lightning  data  observed  at 
relatively  long  range  to  give  estimates  of  field  strengths  at  short 
range  is  not  a  straightforward  process,  particularly  for  the 
high-frequency  part  of  the  lightning  spectrum.  In  addition  io  the 
ground-return  strokes  of  some  kilometers  in  length,  lightning  includes 
a  large  number  (on  the  order  of  10*)  of  smaller  events  of  some 
meters  in  length,  which  contribute  much  of  the  higher-frequency  energy 
(Uman  et  al.,  1978;  Rustan,  Uman,  et  al.,  1980).  Unless  measurements 
are  made  with  appropriately  vide-band  receivers,  which  distinguish 
short-duration  individual  eventsf  extrapolation  errors  are  likely  to 
occur.  Narrow-band  receivers,  foe  example,  may  integrate  the  power 
from  many  small  events  when  measuring  at  a  distance.  In  this  case 
extrapolation  of  results  to  short  ranges  can  become  erroneous.  At 
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short  ranges  only  a  few  of  the  isolated  events  producing  high- 
frequency  waves  will  be  near  the  target  system*  (See  Cianos  and 
Pierce,  1972). 

Although  lightning  has  a  number  of  characteristics  in  common  with 
EMP,  the  differences  are  so  important  that  lightning  does  not  appear 
to  provide  a  satisfactory  system  test  mechanism  to  ensure  safety 
against  nuclear  EMP. 


TAILORED  HARDENING 

The  committee  heard  a  number  of  presentations  describing  the  "tailored- 
hardening"  approach  to  EMP  protection.  This  approach  was  applied  both 
in  the  retroactive  hardening  of  systems  that  were  not  specifically 
designed  to  survive  the  EMP  environment  and  in  the  development  of  new 
systems. 

In  the  tailored-hardening  approach,  the  engineer  responsible  for 
EMP  protection  uses  mathematical  models  of  a  system  to  estimate  the 
voltages  and  currents  that  will  appear  at  the  electrical  interfaces  to 
electronic  modules  (circuit  boards)  in  the  system.  The  engineer 
attempts  to  estimate  the  susceptibility  of  these  modules  to  EMP  damage 
by  examining  circuit  documentation  available  from  the  design  and 
production  phases.  Cases  are  identified  where  the  EMP  stress 
predicted  by  the  models  exceeds  the  calculated  susceptibility  levels 
of  the  modules.  Corrective  action  m  the  form  of  protection  devices 
or  module  modifications  is  taken  to  eliminate  these  situations. 

Although  the  committee  recognized  the  value  of  modeling  in 
understanding  mote  clearly  the  nature  and  magnitude  of  the  BMP 
problem,  it  is  skeptical  of  the  assurance  one  can  have  in  the  hardness 
of  systems  protected  by  these  methods  for  the  following  reasons: 

1.  The  methods  of  analysis  used  to  predict  susceptibility  of 

electronic  modules  to  the  overvoltages  and  overcurrents  induced 
by  EMP  appear  likely  to  result  in  only  very  crude 
approximations  of  actual  susceptibiliites.  This  result  is  due 
not  only  to  the  approximations  used  to  make  the  analyses 
tractable  but  also  to  the  uncertainties  in  the  susceptibilities 
of  components  within  the  modules. 

?,  The  methods  of  analysis  used  to  predict  the  overvoltages  and 
overcurrents  that  might  appear  at  the  module  interfaces  are 
likely  to  produce  estimates  that  are  not  representative  of  the 
real  situation.  This  result  may  occur  both  because 
approximations  are  adopted  to  make  the  analyses  tractable  and 
because  critical  assumptions  about  the  nature  of  the  wiring 
within  the  system  (which  couples  to  EMP)  may  not  necessarily  be 
valid  for  'actual  systems  under  test.  With  typical 
configuration  ranagement  of  complicated  systems,  different 
individual  units  of  the  same  nominal  type  differ  in  important 
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details,  such  as  wiring,  wire  routing,  and  particular 
components  within  the  subsystems.  (See  Appendix  C.) 

3.  Techniques  used  to  add  margin  for  error  caused  by  point  1  and 
point  2,  above,  are  built  upon  a  long  and  tenuous  string  of 
assumptions  and  approximations. 

4.  Most  of  the  tailored-hardening  analyses  attempt  to  identify 
components  that  might  be  damaged  by  EMP.  The  problems 
associated  with  upset  (for  example,  loss  of  stored  information 
or  unintentional  initiation  of  undesirable  actions)  due  to  EMP 
are  typically  not  addressed  by  this  methodology. 

5.  In  systems  that  were  protected  by  the  tailored-hardening 
methods  and  then  exposed  to  simulated  EMP  environments, 
measured  currents  on  conductors  deviated  by  large  amounts  from 
predicted  values.  Unpredicted  "surprises"  (failures  and 
upsets)  occurred.  These  results  tended  to  increase  the 
committee's  reservations  regarding  the  assurance  one  can 
ascribe  to  the  hardening  of  systems  protected  in  this  manner. 

In  spite  of  the  skepticism  gust  expressed  as  to  thfe  protection 
attainable  with  tailored  hardening,  the  committee  still  views  the 
associated  analysis  as  a  useful  methodology  for  dealing  with  the  EMP 
susceptibility  of  existing  systems  not  amenable  to  new  design.  The 
tailored-hardening  analysis  can  identify  opportunities  to  reduce  EMP 
susceptibility  further.  We  believe,  however,  that  roost  of  the 
benefits  of  tailored  hardening  come  from  good  engineering  practices 
verified  by  full  threat-level  tests  and  not  from  derailed  analysis  or 
statistical  inference  based  on  the  variations  mentioned  above  in  the 
susceptibilities,  predicted  overvoltages,  and  measured  currents. 

The  committee,  moreover,  is  uncomfortable  with  the  use  of  tailored 
hardening  as  a  methodology  to  design  new  systems.  The  concern  is  both 
with  the  ability  to  protect  systems  by  these  methods  and  with  the 
ability  to  retain  protection  as  systems  are  modified  or  maintained. 
These  concerns  increase  with  the  introduction  of  increasingly  complex 
and  vulnerable  circuitry  as  a  result  of  progress  like  very  large  scale 
integration  (VLSI)  and  very  high  speed  integrated  circuits  (VHSIC) . 


SHIELDING 

The  committee  also  heard  presentations  on  the  protection  strategy 
called  shielding.  In  this  approach  the  system  or  subsystem  designer 
i3  tasked,  within  constraints  such  as  weight  and  cost,  to  prevent  EMP 
effects  from  reaching  susceptible  components,  rather  than  hardening 
the  components  themselves.  No  established  standards  for  shielding 
exist  as  yet.  However,  the  strategy  is  to  accomplish  the  shielding, 
by  means  of  metallic  films,  screens,  or  enclosures,  to  a  sufficient 
degree  that  the  residual  fields,  produced  by  EMP  at  the  components 
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inside  the  shield,  are  small  compared  to  the  fields  that  are  present 
in  normal  operation.  Furthermore,  measures  must  be  implemented  to 
prevent  currents  produced  by  EMP  in  nonshielded  metallic  conductors, 
such  as  antennas,  from  being  carried  into  the  shield  interior  by 
conductors,  such  as  lead-in  transmission  lines,  that  penetrate  the 
shield.  By  implication,  if  the  components  function  properly  in  normal 
operation,  the  small  incremental  disturbances  produced  by  EMP  will 
disrupt  only  subsystems  that  are  already  functioning  marginally. 

These  effects  will  be  identical  to  isolated  random  failure  effects  and 
will  be  protected  against  by  normal  system  redundancy  and  gradually 
eliminated  by  normal  system  upgrading. 

Shielding  has  a  key  advantage  over  tailored  hardening  in  assessing 
system  hardness.  Specifically,  one  does  not  have  to  know  the 
susceptibilities  of  components,  such  as  transistors  and  integrated 
circuits,  or  subsystems,  such  as  computers,  within  the  shield  because 
the  EMP  stress  is  reduced  to  levels  below  those  to  which  they  are 
exposed  in  normal  operation. 

Shielding  should  be  able  to  provide  protection  against  EMP  effects 
with  a  very  high  degree  of  assurance  if  the  following  criteria  are 
satisfied: 

1.  The  shielding  methodology  must  be  simple  and  readily 
standardized  in  order  that  the  effectiveness  of  the  shielding 
can  be  readily  understood  and  verified. 

2.  The  shielding  must  be  amenable  to  continuous  or  periodic 
in-service  "proof  testing*  to  verify  retention  of  EMP 
protection. 

3.  The  shielding  methodology  preferably  should  be  modular,  whereby 
individual  subsystems  can  be  protected — and  certified  to  be  so 
by  testing — and  whereby  the  interconnection  of  the  protected 
subsystems  into  a  system  does  not  compromise  the  protection. 
This  approach  would  make  system  protection  independent  of  minor 
Variations  lr.  system  configuration,  provided  the  modules 
(subsystems)  comprising  the  system  are  all  verified  to  be 
protected. 


Shielding  of  Entire  Systems 

The  committee  heard  several  presentations  that  described  examples  of 
entire  systems  that  had  been  shielded  to  protect  against  EMP.  These 
examples  included  strategic  missiles,  aircraft,  large  communication 
j  complexes,  and  relatively  small  buildings  that  formed  elements  of  a 

strategic  command  relay  system.  Shielding  of  buildings,  where  weight 
is  not  a  factor,  appears  to  be  reasonably  straightforward  and  appears 
to  satisfy  the  first  two  criteria  in  the  preceding  section.  This 
approach  was  described  by  Morgan  (Appendix  B,  presentation  on  April 
1-2,  1983),  by  Chodorow  (Appendix  B,  presentation  on  September 
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30-October  1,  1983),  and  by  Cikotas  in  his  discussions  of  the  Gtound 
Wave  Emergency  Network  (GWEN)  system  (Appendix  B,  presentation  on 
April  1-2,  1983).  We  emphasize  that  continuing,  in-service  proof 
testing  is  vital  because  any  large,  long-term  installation  is  subgect 
to  modification  by  workers  who  may  not  be  aware  of  how  hardness  is 
achieved  and  preserved  and  who  may  destroy  the  shielding 
inadvertently. 

Shielding  of  missiles  and  aircraft  is  more  complex  because  of  the 
constraints  on  the  shielding  design  imposed  by  airworthiness  and 
aircraft  configuration.  Testing  and  redesign  of  the  shielding  through 
several  iterations  have  been  required  to  produce  satisfactory  test 
results.  In  the  case  of  missiles  and  aircraft,  it  does  not  appear 
that  either  criterion  1  or  criterion  2  in  the  preceding  section  is 
satisfied.  On  the  other  hand,  the  committee  feels  that  total 
shielding  of  aircraft  and  missiles,  making  use  of  the  aircraft  skin 
and  of  films  or  screens  over  apertures,  is  useful  when  carefully 
implemented. 


Shielding  of  Subsystems  Interconnected  by  Fiber  Optics 

One  possible  shielding  approach  is  to  house  relatively  small 
subsystems  in  standardized  shielded  enclosures  and  to  interconnect  the 
subsystems  with  fiber  optic  communication  links.  This  approach,  in 
which  subsystems  are  in  shielded  boxes,  racks,  and  compartments,  for 
example,  is  applicable  to  both  ground-based  and  airborne  systems.  The 
penetrations  for  power  could  be  standardized  and  readily  tested  for 
effectiveness.  The  relatively  small  shielded  subsystems  could  be 
individually  tested  against  EMP  in  moderately  sized  simulators.  Since 
EMP  does  not  couple  to  the  fibers,  various  configurations  of 
Individually  shielded  subsystems  could  be  assembled  with  the 
expectation  that  the  systems  would  be  EMP-protected  if  the  subsystems 
were.  Verification  of  shielding  effectiveness  could  be  accomplished 
in  several  ways— for  example,  by  continuous -wave  field  generators 
outside  the  shielded  entities  monitored  by  sensors  inside  the  shielded 
entities.  These  sensors  could  report  monitoring  data  by  fiber  optic 
link  without  any  concern  for  coupling  EMP  into  the  shield  via  the 
reporting  link. 


CONCLUSIONS  AND  RECOMMENDATIONS  CONCERNING  PROTECTION 

Hie  principal  conclusions  of  this  chapter  deal  with  assessability  of 
system  design,  the  tailored-hardening  approach,  and  the  shielding 
approach. 


Both  the  design  and  the  assessment  of  protection  against  EMP  are 
necessarily  subject  to  uncertainty  because  these  processes  must  be 
conducted  without  exposure  to  actual  EMP,  in  contrast  to  the  situation 
for  other  forms  of  electrical  overstress.  Accordingly,  the  degree  of 
assessability  depends  neavily  on  the  design  of  the  protection. 
Assessability  is  facilitated  when  the  EMP  stresses  coupled  into  the 
system  are  limited  to  values  small  compared  with  nominal  system 
voltages  and  currents.  It  should  also  facilitate  assessability  to 
control  the  uncertainties  in  the  response  of  components  and  subsystems 
within  a  narrow  range.  Additionally,  a  protection  strategy  that 
allows  large  systems  to  be  fully  tested  as  small,  individually 
hardened  modules  will  favor  assessability. 

We  strongly  favor  shielding,  where  possible,  as  the  most  assessable 
method  of  protection.  Shielding,  combined  with  careful  penetrations 
control  (such  as  standardized  and  certified  power  penetration  methods, 
specialized  protection  for  antenna  leads,  and  fiber  optic  signal 
penetrations),  satisfies  our  criteria  of  controlled  attenuation  of  EMP 
stress,  simplicity,  modularity,  and  testing.  Accordingly  high 
assurance  in  attaining  EMP  protection  should  be  demonstrable. 

However,  complex  shield  geometries  with  numerous  shield  violations  and 
patches  do  not  generate  the  high  degree  of  protection  and 
assessability  afforded  by  simple,  continuous  shields.  In-service 
proof  testing  is  necessary  to  verify  that  protection  is  maintained. 

The  use  of  fiber  optics  will  facilitate  modular  shielding  by 
substituting  for  many  metallic  signal  paths  between  subsystems, 
especially  if  the  technique  of  multiplexing  can  be  used. 

By  contrast,  the  tailored-hardening  approach  provides  neither 
highly  effective  nor  confidently  assessable  protection  because  of  its 
many  poorly  controlled  uncertainties.  Nevertheless  we  recognize  that 
the  methods  of  tailored  hardening  are  useful  for  improving  protection 
of  large,  existing  systems. 

The  following  recommendations  flow  from  these  conclusions: 

1.  Protection  should  be  implemented  with  regard  for  the 
cost-benefit  tradeoff  perceived  for  alternative  designs. 

2.  Research  and  development  should  be  continued  to  identify 
vulnerable  components  and  improvements  that  might  be  made  to 
reduce  their  vulnerability.  The  results  would  be  useful  to  the 
tailored-hardening  approach. 

3.  Analytical  efforts  should  be  continued  on  the  nature  of  EMP 
coupling  phenomena.  The  results  would  be  useful  to  the 
tailored-hardening  approach.  However,  we  are  skeptical  as  to 
the  usefulness  of  analytical  methods  for  describing  the 
sensitivity  of  coupling  phenomena  to  the  uncontrollable  details 
of  system  structure,  such  as  cable  routing. 

4.  Statistical  design  and  evaluation  of  experiments  to  assess 
achieved  hardness  should  be  employed  because  the  variability 
between  near  copies  of  a  nominally  similar  design  is  often 
appreciable  and  needs  to  be  controlled  more  narrowly. 
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STATISTICAL  TECHNIQUES  IN  ELECTROMAGNETIC  PULSE  WORK 


Statistical  techniques  are  employed  to  grapple  with  the  many  aspects 
of  variability  and  uncertainty  in  electromagnetic  pulse  (EMP) 
effects.  Although,  for  purposes  of  estimating  vulnerability,  the 
incident  BMP,  described  in  Chapter  2,  is  assumed  to  have  fixed, 
nominal  values,  its  characteristics  will  vary  in  operational 
situations.  Unavoidable  variability  and  uncertainty  are  also 
encountered  in  the  degree  of  coupling  of  BMP  stress  -into  Bystem 
Circuits,  the  strength  of  circuit  components  in  withstanding  EMP 
stresses,  and  the  analytical  approximations  used  in  estimating  and 
combining  these  stresses  and  strengths.  Even  the  tests  conducted  on 
systems  and  subsystems,  to  evaluate  protective  measures  that  have  been 
applied,  produce  variable  results  that  need  analysis  and 
interpretation.  This  chapter,  together  with  its  related  appendixes, 
examines  how  statistics  has  sometimes  been  used  in  the  EMP  community 
and  suggests  some  further  useful  approaches,  interpretations,  and 
applications  of  statistical  and  probabilistic  methods. 


VARIOUS  MEASURES  OF  VULNERABILITY 


Various  measures  of  vulnerability  are  useful,  depending  on  the  level 
of  system  complexity  under  consideration.  These  measures  are  often 
used  in  connection  with  the  protection  and  assessability  problems 
described  in  Chapter  3. 


Threshold 

At  the  component  level  a  useful  measure  is  the  lowest  stress  at  which 
failure  occurs — comm only  called  'threshold*  or  'strength*  (Wunsch  and 
Bell,  1968).  Thresholds  are  commonly  assumed  to  be  random  variables, 
distributed  over  some  range  because  of  unknown  variations  in  design 
and  manufacture.  (See  Chapter  3.) 
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Thresholds  are  useful  In  studying  the  failure  mechanism  of 
electronic  components  so  that  their  design  may  be  improved. 

Thresholds  also  enter  into  the  calculation  of  the  failure  level  of  a 
complete  circuit.  Bowever,  this  measure  is  not  useful  by  itself  in 
assessing  system  performance.  The  reason  is  that  the  applied  stresses 
coupled  into  a  system  by  BMP  are  distributed  with  considerable 
uncertainty  over  a  range  of  values. 


Safety  Margin 

Safety  margin — that  is,  some  multiple  of  the  difference  between 
failure  threshold,  or  strength,  and  applied  stimulus,  or  stress — is  a 
more  useful  measure  than  strength  alone  in  estimating  vulnerability  at 
the  coeiponent  and  circuit  level  (Egelkrout,  1978) . 

Stress  in  an  actual  BMP  event  arises  from  the  incident 
electromagnetic  pulse  and  its  coupling  to  circuits  within  electronic 
systems.  The  incident  pulse  will  vary  with  parameters  that  describe 
the  nuclear  burst,  the  geometry  of  the  burst  and  observer,  and 
geophysical  conditions.  The  stress  coupled  to  a  point  within  the 
system  will  also  vary  with  parameters  of  the  system.  These  variations 
are  known  in  fact  or  in  principle.  (See  Appendix  C.)  However,  to  the 
extent  that  the  values  of  the  pai  ameters  upon  which  the  stress  depends 
are  distributed  because  of  uncertain  knowledge  or  random  effects,  the 
magnitude  of  the  stress  itself  is  distributed. 

Safety  margin,  therefore,  is  commonly  assumed  to  be  a  random 
variable  because  of  the  unknown  variations  of  strength  and  stress. 

The  probability  that  safety  margin  exceeds  some  constant,  say  zero, 
may  be  estimated.  Bounding  values  for  thiB  probability  may  then  be 
obtained  corresponding  to  some  stated  confidence  level,  say  95 
percent.  (See  Appendix  F.)  Then  this  information  may  be  used  in  the 
design  and  evaluation  of  protective  meaures. 


Binary  Measure 

Another  possible  measure  of  vulnerability  is  the  binary,  or  "go-no 
go,"  decision.  This  measure  amounts  to  an  assignment  to  a  system  of 
probability  of  failure  equal  to  either  one  or  zero.  Some  contract 
specifications  appear  to  call  for  binary  evaluations.  He  discourage 
the  use  of  this  measure  because  these  extreme  values  of  probability 
are  not  representative  of  real  situations. 


Probability  of  Survival 

Probability  of  survival  (POS)  of  a  system  until  completion  of  a 
prescribed  mission  is  another  measure  of  system  hardness  and 


vulnerability.  The  concept  implies  some  overall,  quantitative 
estimate — properly  accompanied  by  some  measure  of  its 
uncertainty — that  a  system  will  function  as  intended. 

However,  even  to  workers  in  the  field,  it  does  not  seem  to  be  clear 
how  the  X)S  approach  to  EM?  assessment  is  currently  defined  and 
employed.  This  is  one  area  which  needs  further  discussion  and 
elaboration.  For  example,  what  is  the  BMP  community's  interpretation 
of  probability?  Is  it  subjective  or  objective?  Should  not  clear 
Indications  of  how  sensitive  these  estimates  are  to  the  assumptions 
and  the  data  always  be  given  to  avoid  misuse  of  PCS?  A  satisfactory 
discussion  of  these  issues  should  involve  all  parties  involved:  the 
Defense  Nuclear  Agency,  its  contractors,  program  managers  for  systems 
development,  and  the  users  of  the  system. 


ON  THE  CURRENT  USE  OF  STATISTICS  IN  THE 
ELECTROMAGNETIC  PULSE  COMMUNITY 

The  committee  examined  a  wide  range  of  statistical  work  undertaken  in 
EMP  vulnerability  problems  and  judged  it  to  be  straightforward  and 
businesslike.  However,  based  partly  on  the  examples  to  follow  and 
partly  on  the  collective  judgment  on  what  our  statistics  experts  saw 
and  heard,  we  believe  the  work  lacks  the  depth  and  sophistication 
needed  to  address  key  issues  in  estimating  vulnerability. 

For  example,  there  was  no  randomization  in  choosing  aircraft  to  be 
tested  on  the  TRESTLE  simulator.  Similarly,  in  tests  of  a  critical 
aircraft  only  a  small  fraction  of  the  electrical  terminals  was  tested 
(Appendix  B,  presentation  by  Van  Zandt,  September  30-October  1, 

Iii33).  These  terminals  were  selected  in  too  systematic  a  fashion. 

Good  experimental  design  requires  that  some  test  points  be  selected  at 
random.  Such  a  design  partially  protects  the  experimenter  from  the 
possibility  of  failing  to  observe  unexpected  effects  that  in  fact 
exist  but  do  not  appear  among  the  systematically  selected  test  points. 

There  is  little  evidence  of  continuous  guidance  from  experienced 
and  well  trained  statisticians  in  the  work  on  EMP  described  in  the 
presentations  to  the  committee  (Appendix  B)  and  the  literature 
(References  and  Other  Documents  Examined  by  the  Committee) .  With  the 
exception  of  an  occasional  statistical  consultant  or  someone  with  an 
advanced  degree  in  statistics,  past  work  seems  to  have  depended  mainly 
on  statistical  input  from  engineers  or  mathematicians  with  little  or 
no  formal  training  or  practical  experience  in  statistics. 

As  a  result  some  difficult  but  important  issues  have  not  been 
clearly  articulated  or  understood.  Potentially  fruitful  uses  of 
moderately  sophisticated  methods  of  data  analysis  are  not  cited. 

There  is  evidence  of  confusion  regarding  the  use  of  statistical 
terminology  and  the  interpretation  of  statistical  notions.  An  example 
of  such  confusion,  discussed  at  greater  length  in  Appendix  E,  is  the 
meaning  and  use  of  "confidence  limits."  Another  examcie  ir.  the 


29 


interpretation  of  the  term  "probability  of  survival."  The  committee 
was  not  presented  with  a  single  example  that  discussed  detailed 
statistical  calculations  and  analyses  leading  to  the  estimate  of  POS 
for  a  large  complex  system;  nor  has  the  role  of  POS  in  decision  making 
been  well  articulated  in  the  analyses  and  literature  brought  to  our 
attention.  Uncertainties  in  POS  values  are  not  expressed 
quantitatively. 

In  many  of  the  presentations  and  reports  on  threshold  failure  that 
were  made  available  to  the  committee  (for  example,  Alexander  and 
Enlcw,  1981)  efforts  were  made  to  ascertain  the  form  of  the  failure 
distributions  from  sparse  data.  However,  sparse  data  alone  should  not 
be  used  to  extrapolate  to  the  tails  of  probability  distributions.  One 
must  have  some  basis  other  than  a  few  observations  for  choosing  a 
distribution  and  describing  its  tail  (Appendix  F) • 

Documentation  of  long  engineering  and  statistical  experience,  such 
as  that  of  Parker  (Appendix  B,  presentation  on  June  1*2,  1983)  and 
Jones  (Appendix  B,  presentation  on  Hay  21,  1983),  has  not  been 
prepared.  Such  documentation  would  be  useful,  not  only  as  a  record  of 
accomplishments  but  also  as  an  educational  aid.  Although  Parker  has 
been  in  the  business  for  20  years,  our  visit,  we  were  told,  was  the 
first  occasion  on  which  he  had  been  asked  to  give  a  perspective  talk 
on  his  work. 

In  view  of  these  conclusions,  we  have  included  at  the  end  of  this 
chapter  specific  recommendations  on  the  role  of  statistical  expertise, 
use  of  statistical  concepts  and  methods,  and  educational  opportunities 
in  the  EMP  community. 


POTENTIAL  ROLE  OF  STATISTICS 

Statistics  has  played  an  important  role  in  assessing  the  reliability 
of  strategic  systems  and  the  safety  of  nuclear  power  plants. 
Statistical  thinking  and  methodology,  if  seriously  undertaken,  can 
play  a  useful  role  in  assessment  of  vulnerability  to  EMP.  Statistical 
science  can  assist  in  wise  acquisition  of  data  through  test  and 
simulation  design  and  can  suggest  reasonable  analyses  and 
interpretations  of  the  data.  Statistical  methodology  based  on 
probability  theory  can  provide  some  assessment  of  the  uncertainty  in 
decision-related  parameters,  such  as  probability  of  survival*  The 
basic  uncertainties  are,  however,  beat  understood  and  reduced  by  the 
careful  conduct  of  tests  and  application  of  scientific  principle. 
Indirectly,  but  importantly,  statistical  science  can  contribute 
towards  improving  the  hardness  of  a  system  by  policing  and  pointing 
out  weak  spots  in  the  system  design  and  its  hardening  and  identifying 
other  such  deficiencies  that  may  be  hard  to  detect  on  an  intuitive 
basis.  Thjs  statistics,  in  the  context  of  EMP,  is  a  device  for 
measurement  and  assessment;  the  language  of  statistics  enables  one  to 
express  uncertainty  about  the  EMP  vulnerability  of  a  system.  The  role 
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of  statistics  in  EMP  protection  and  assessment)  therefore,  is  not 
merely  central  but  is  essential  and  inevitable. 

Some  useful  applications  of  statistics  at  various  levels  of  the  EMP 
problem  are  given  below. 


Hardening  of  Transistors,  Integrated  Circuits, 

Devices,  and  Piece-Parts 

There  is  available  some  knowledge  and  theory  about  the  characteristics 
of  electronic  components  and  integrated  circuits  that  affect  their 
vulnerability  to  EMP  and  related  phenomena.  This  understanding  is  fat 
from  complete,  and  improvement  would  be  desirable.  Improved 
understanding  could  lead  to  the  establishment  of  manufacturing 
techniques  that  would  reduce  the  extent  of  EMP  hardening  required  and 
probably  reduce  the  extent  of  other  types  of  failures  too. 

One  sign  of  the  potential  usefulness  of  more  understanding  is  that 
tests  have  shown  that  components  manufactured  by  different  suppliers 
to  meet  the  same  specifications  vary  widely  in  their  vulnerability  to 
test  pulses  of  voltage  and  current.  Experiments  have  beer,  carried  out 
to  help  determine  the  characteristics  of  manufacture  that  influence 
the  hardness  of  these  components.  At  least  one  of  these  tests 
(Alexander,  Enlow,  and  Karaskiewicz,  1980;  Alexander,  Karaskiewicz, 
and  Enlow,  1981)  has  yielded  vast  amounts  of  data,  but  no 
investigation  has  made  more  than  a  naive  analysis  of  these  data  up  to 
the  time  of  this  report. 

With  the  help  of  statistical  knowledge  in  such  areas  as  life 
testing,  design  of  experiments,  multivariate  analysis,  goodness-of-f it 
tests,  graphical  analysis,  and  threshold  estimation,  and  with  the 
cooperation  of  physical  scientists  working  on  components  and  circuits, 
it  seems  likely  that  more  efficient  experiments  and  system  and 
subsystem  tests  could  be  performed  and  that  more  useful  results  could 
be  derived  from  the  analysis  of  the  data.  In  Appendix  F  some  ideas 
are  outlined  for  improvements  in  statistical  estimation  of  safety 
margins  based  on  stress-strength  models. 


Testing  at  the  Medium,  or  "Box,"  Level  ~  ' 

The  level  of  the  functional  circuit,  or  "box,"  is  intermediate  between 
circuit  component  and  subsystem.  If  hardness  can  be  measured  by 
achieved  margin  and  if  test'  are  conducted  that  yield  appropriate 

data,  then  statistical  ideas  can  be  used  in  such  test  design  and  m 

analysis.  Statistical  methods,  including  analysis  of  variance  and 

regression  studies  of  survival  data,  can  help  characterize  variability 

in  achieved  hardness  (margins)  between  boxes  under  different  test 

conditions.  Modern  statistical  methods,  Involving  computer  graphics, 

for  instance,  can  point  up  unsuspected  sources  of  variation  and 
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opportunities  foe  better  understanding  and  improvement.  Thu3  tests  on 
the  wall-shielded  box  can  be  evaluated.  Because  of  testing 
limitations  and  anticipated  variability,  statistics  will  play  a  role 
in  characterizing  the  extent  to  which  planned  margins  of,  say,  100 
dec! be la  are  achieved.  That  is,  it  will  be  useful  to  quote  standard 
errors,  probability  limits,  or  confidence  limits  to  describe 
variability  between  copies  and  to  characterize  and  account  for  the 
effects  of  measurement  error. 


Testing  and  Evaluation  of  Large  Systems 

Large  modern  systems  have  not  been  exposed  to  BMP  from  an  actual 
nuclear  device.  Thus,  we  must  depend  on  simulations  and  on 
theoretical  models  relating  the  simulation  tests  to  real  EMP.  He  hope 
that  there  are  no  highly  unusual  effects  that  have  not  been  foreseen 
in  the  models.  He  must  bo  aware  of  that  possibility,  however,  and  be 
alert  to  avoid  surprises.  Chapter  3  discusses  some  limitations  on  the 
fidelity  of  the  simulation  and  on  the  type  and  quantity  of  data  that 
may  be  taken.  These  limitations,  of  course,  increase  the 
uncertainties  of  the  test  results. 

Large  systems  such  as  the  B-52  aircraft,  the  B-747  aircraft,  the 
command-post  helicopter,  and  buildings  on  a  base  can  be  tested  in  a 
limited  manner,  such  as  is  done  on  the  TKESTLE  EMP  simulator.  Such 
tests  are  expensive,  but  they  may  well  be  much  less  so  than  the  costs 
of  operational  failure. 

Pirst-rate  statistical  effort  will  help  to  answer  the  following 
important  questions: 

1.  Hew  should  one  choose  a  copy  or  copies  of  the  system  to  be 
tested?  To  what  extent  should  the  choice  be  randomized?  How 
does  one  understand  the  variability  oetween  copies  and 
extrapolate  to  other  copies? 

2.  How  should  one  choose  a  subset  of  the  possible  points  on  the 
system  that  can  be  tested? 

3.  How  should  the  principles  of  accelerated  life  testing  be  used 
in  devising  such  tests  and  interpreting  the  results? 

4.  How  may  one  economize  on  the  amount  of  testing  done? 

5.  How  should  teat  data  be  combined  with  engineering  opinion? 

6.  How  should  expert  opinion  be  revised  as  a  result  of  test  data? 

7.  How  should  decision::  be  made  regarding  the  hardness  of  the 
system  based  on  the  results  of  the  test?  For  example,  what 
experimental  results  should  lead  to  the  modification  of  the 
system  design  or  more  hardening  or  the  decision  that  present 
hardening  is  adequate? 

8.  How  may  test  design  help  to  characterize  the  physical  sources 
of  uncertainty? 
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By  contrast,  this  committee  had  very  little  indication  of  how  the 
data  from  the  TRESTLE  simulator  tests  are  analyzed  end  what,  if  any, 
conclusions  have,  or  can  be,  drawn  from  these  tests  about  the  general 
principles  of  EMP  hardening. 


Assessment  of  Huge  Systems  That  Cannot  Be  Tested 

Huge  systems,  such  as  the  national  power  transmission  system  and  the 
telephone  system,  cannot  be  tested  as  a  whole.  The  best  approach  in 
these  cases  may  be  statistical  models.  The  techniques  of  fault  tree 
analysis  could  be  very  useful.  Fault  tree  analysis  seems  to  be  a 
natural  methodology  for  deriving  quantitative  estimates  of  hardness  of 
such  large  systems.  Bayesian  methods  may  well  allow  assignment  of 
meaningful  uncertainty  statements  on  probability  of  failure. 

However,  tnert  are  difficulties;  these  will  have  to  be  overcome  by 
a  careful  analysis  and  detailed  considerations.  Examples  are  how  to 
integrate  properly  the  individual  parts  of  an  analysis  and  hew  to 
treat  independence  or  lack  thereof.  We  emphasise  that  analysis:  can 
only  produce  guidelines.  Valuable  as  the  resulting  quidslines  may  be, 
every  attempt  must  be  made  to  check  for  their  plausibility  and  their 
implication  for  policy.  Some  work  has  begun  on  the  application  of 
Bayesian  methods  to  estimaVuq  vulnerability  of  huge  systems  to  EMP 
(Appendix  B,  presentat  _  Jewman,  April  1-2,  1983;  Appendix  B, 
presentation  by  Mensing,  August  9-10,  1983). 


Verification  of  Shielding  Integrity 

A  key  element  in- protection  by  shielding  is  assuring  that  an  adequate 
shield  is  maintained.  One  possible  approach  to  verification  is  to 
incorporate  automatic  testing  equipment  to  monitor  the  extent  to  which 
shielding  is  being  maintained.  It  is  plausible  that  sound  statistical 
quality  control  can  be  employed  to  detect  deterioration  j.’  ielding 
quality  well  before  the  deterioration  becomes  dangerous  or  difficult 
to  repair.  Automatic  test  equipment  is  itself  susceptible  to  failure 
and  the  generation  of  false  alarms.  Statistical  modeling  and 
reliability  theory  can  be  used  to  evaluate  the  probability  of  false 
alarms.  The  goal  is  to  increase  alarm  sensitivity  to  true  threats  to 
security  without  unduly  increasing  the  false  alarm  rate. 


WHAT  IS  PROBABILITY? 

Estimating  vulnerability  to  EMP  effects  deals  inherently  with 
uncertain  avents.  It  may  be  cogently  argued  that  the  most  meaning  fil 
way  by  which  to  express  uncertainty  about  an  event  is  in  terms  of 
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probability.  Therefore,  some  discussion  of  basic  aspects  of  this 
concept  is  in  order  as  a  foundation  for  its  useful  application.  The 
mathematical  theory  of  probability  is  an  abstract  theory  based  on  a 
few  axioms  relating  the  terms,  probability  and  event.  This  theory 
need  not  have  anything  to  do  ;:ith  the  rea)  world  until  probability  and 
event  are  given  concrete  interpretations  in  the  real  world.  Then  the 
conclusions  from  the  theorems  of  probability  will  apply  to  the 
situation  at  hand.  Two  alternative  interpretations  of  probability 
have  attained  practical  importance. 


Frequentist  Interpretation 


One  possible  interpretation  for  a  theory  of  probability  is  the 
frequentist  one.  Consider  an  experiment,  such  as  coin  tossing  or  card 
shuffling  and  play,  which  may  be  repeated  under  similar  circumstances 
many  times  and  for  which  the  outcomes  may  be  different.  An  event  is 
considered  to  be  a  subset  of  the  possible  outcomes.  The  event  occurs 
or  succeeds  if  the  outcome  of  the  experiment  is  in  the  event.  The 
probability  of  that  event  is  the  long-run  proportion  of  times  that  the 
event  occurs  or  succeeds — that  is,  its  relative  frequency  of  occur¬ 
rence.  The  applicability  of  the  mathematical  theory  of  probability  is 
tied  to  the  assumption  that,  as  the  number  of  repetitions  (trials) 
increases  indefinitely,  the  proportion  of  successes  of  an  event  will 
tend  to  a  limiting  value.  While  this  assumption  cannot  be  checked 
directly  by  repeating  an  infinite  number  of  trials,  it  can  be  tested 
by  checking  whether  predictions  based  or.  the  theory  of  probability  are 
reasonably  well  satisfied.  For  example,  suppose  a  coin  were  tossed 
10,000  times  and  one  noted  the  difference  betwean  the  oumboce  of  heads 
in  the  first  5,000  tosses  and  the  second  5,000.  It  would  be 
aurpri&ing,  if  the  usual  theory  (Bernoulli  trials)  were  appropriate, 
to  find  that  this  difference  were  more  than  100.  It  would  be  very 
surprising  if  the  difference  were  more  than  150.  Or  to  turn  it  about, 
experimental  determination  of  the  parameters  of  the  probability  model 
will  be  in  some  error;  but  the  theory  may  be  used  to  characterize  the 
errors. 

The  frequentist  interpretation  is  not  adequate  to  handle  some 
applications.  For  example,  this  interpretation  is  difficult  to  apply 
to  situations  where  the  experimental  setup  is  not  easily  replicated. 
Thus,  the  economist  who  wishes  to  apply  probability  theory  cannot 
repeat  experiments  under  similar  circumstances,  since  changes  that 
have  major  influences  on  the  outcomes  are  always  taking  place.  Some 
philosophers  then  like  to  think  in  terms  of  conceptual  repetitions. 
Others  prefer  to  test  theories  involving  probabilities  by  seeing  how 
well  their  predictions  are  satisfied.  In  effect  the  probability  model 
is  tested  as  part  of  the  theory.  Thus,  a  theory  that  assigns 
probability  greater  than  0.9  to  each  of  50  independent  events  will  not 
be  well  supported  if  only  30  of  these  occur.  (See  Savage,  1962;  Luce 
and  R&iffa,  1957.) 
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Subjective  Interpretation 

Another  interpretation  of  probability  is  a  subjective  one,  which 
measures  probability  in  terms  of  conditions  under  which  one  is  willing 
to  bet.  For  example,  if  you  are  offered  $1  to  predict  correctly  the 
outcome  of  the  toss  cf  a  possibly  biased  com,  your  considered  choice 
of  a  head  would  mean  that  your  subjective  probability  for  heads  is  at 
least  0.5.  Your  probability  could  be  narrowed  by  considering  your 
choices  in  a  variety  of  bets  where  the  reward  depends  on  the  outcome 
of  the  coin  toss. 

This  interpretation  satisfies  the  axioms  of  probability  if  one 
assumes  that  your  choices  satisfy  some  assumptions  of  consistency  and 
rationality  (Savage,  1962).  These  assumptions  form  the  justification 
for  the  so-called  Bayesian,  or  subjective,  method  of  statistical 
inference.  This  method  is  a  useful,  formal  way  of  quantifying  one's 
degree  of  belief  concerning  the  uncertain  outcomes  of  experiments. 
Degree  of  belief,  as  expressed  by  subjective  probability,  can  be,  and 
should  be,  based  on  informed  and  scientific  opinion.  In  this  approach 
the  statistician  expresses  his  uncertainty  in  terms  of  prior 
probability  distributions  on  the  unknown.  After  observing  the  results 
of  the  experiments,  one  applies  Bayes'  theorem  tp  compute  posterior 
probabilities  given  the  data.  The  role  played  by  data,  then,  >s  to 
revise  previously  held  opinions. 

There  are,  it  turns  out,  variations  on  the  above  theme  (see,  for 
example,  Jeffreys,  1961;  Bindley,  1965;  Shafer,  1976;  Dempster,  1967; 
Dempster,  1968).  But  the  appealing  attribute  of  Bayesian  statistics 
is  the  ease  with  which  personal  probability  assessments  and  data  may 
be  combined  to  produce  a  final  statement  of  the  belief  probability  of 
various  uncertain  outcomes  of  some  process  on  the  basis  both  of  prior 
probability  distributions  and  of  data. 


Relative  Appropriateness  of  the  Interpretations 

There  has  been  controversy  among  statisticians  about  the  relative 
appropriateness  of  the  Bayesian  approach  and  the  more  classical 
objective,  or  frequentist,  approach  to  statistical  inference.  In  the 
latter  approach  the  unknown  probability  of  the  biased  coin  falling 
heads  is  regarded  as  an  unknown  state  of  nature,  which  is  constant 
(nonrandom)  and  not  subject  to  the  laws  of  probability.  The  objective 
.  j  to  use  data  to  make  inferences  about  the  unknown  state  of  nature, 
on  which  wise  decisions  can  be  based.  By  contrast,  the  Bayesian 
expresses  a  personal  uncertainty  about  this  unknown  quantity  in  terms 
of  a  (prior)  probability  distribution,  effectively  treating  it  as  if 
it  were  random. 

However,  the  practice  of  statistics,  that  is,  the  art  of  the 
recovery  of  information  or  learning  from  data,  does  not  depend  vitally 
upon  the  interpretation  of  probability  that  is  chosen.  Much  useful 
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statistical  work,  along  the  lines  oC  preliminary  investigation  or  the 
exploratory  data  analysis  of  Tukey  (1977),  aakes  little  to  no  use  of 
probabilistic  notions.  In  truth,  there  are  detailed  disagreements 
concerning  the  meaningfulness  of  such  concepts  and  tools  as  classical 
confidence  limits,  hypothesis  tests,  and  significance  levels.  Prom  a 
strict  Bayesian  viewpoint  the  classical  methods  are  “inadmissable." 
Nevertheless,  they  provide  useful  tools.  Strict  classical 
statisticians,  and  some  Bayesians,  are  concerned  with  the  trust  to  be 
put  in  subjective  probability  assessments.  They  object  to  conclusions 
based  on  subjective  prior  probability  distributions,  which  indeed  may 
not  be  unique  when  various  experts  are  involved.  Bayesian  analyses 
that  rely  heavily  upon  subjective  assessment  of  probability  weights 
may  be  expected  to  differ  in  their  implication  for  decisions.  It  is 
reassuring  that  Bayesian  parameter  estimates  and  confidence  limits 
often  differ  only  slightly  from  classical  estimates  and  confidence 
limits,  provided  the  Bayesian  utilises  a  rather  gentle,  vague,  or 
non-informative  prior  distribution  and  there  are  considerable  data. 

If  a  person,  acting  as  an  expert,  assigns  a  highly  Informative  or 
influential  prior  distribution,  then  numerical  results — and 
decisions— -can  be  much  affected.  Sizeable  amounts  of  data  are 
required  to  alter  a  “sharp"  prior  influence  via  Bayes1  theorem. 
Assessment  of  the  compatibility  of  prior  distribution  and  data  has 
been  discussed  by  Dawid  (1973) . 

The  objective  statistician  may  find  it  difficult  to  make  formal, 
probabilistically  supported  decisions  if  there  are  few  or  no  data. 

The  Bayesian  may  prefer  to  gather  evidence,  but  can  make  decisions 
without  directly  relevant  data  if  forced  to  by  circumstances.  Thus, 
situations  that  require  decisions  in  circumstances  where  there  are  few 
experimental  data  and  Borne  prior  beliefs  sometimes  make  the  use  of 
Bayesian  inference  rather  compelling. 

Quantitative  assessments  of  survival  probabilities  can  indeed  be 
elicited  from  experts,  the  prior  distribution  combined  with  whatever 
data  exists,  and  the  results  used  for  decision-making  purposes.  This 
process  should,  however,  be  subjected  to  very  careful  critical 
scrutiny,  diagnostic  checks,  experimental  verification  by  testing  of 
subsystems,  and  continued  attempts  to  validate  the  experts  themselves 
with  a  view  to  comprehending  the  basis  of  their  numerical  statements. 
For  some  discussion  of  personal  probabilistic  assessment  biases  see 
Kahneman,  Slovlc,  and  Tversky  (1982).  The  natural  tendency  to  be 
beguiled  by  the  smoothness  of  the  Bayesian  calculations  should  not 
limit  the  constant  attempt  to  examine  critically  the 
decision-influencing  consequences,  especially  in  areas  as  important  as 
EMP. 

Members  of  the  EMP  technical  and  decision-making  community  should 
understand  these  Issues.  In  particular,  one  should  realize  that,  were 
probabilities  to  be  calculated  under  both  approaches,  there  would  be 
no  logically  tenable  way  of  combining  or  relating  the  two 
probabilities!  they  would  have  entirely  different  meanings.  The 
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thrust  of  work  in  the  area  should  be  to  reduce  uncertainty#  by  careful 
scientific  work,  and  then  to  account  for  what  uncertainty  remains  when 
decisions  are  to  be  made. 


SOME  APPLICATIONS  OF  PROBABILITY 


Application  to  Fault  Tree  Anaylsis 

Fault  tree  analysis  is  a  systematic  method  of  tracing  the  effects  of 
failures  at  lower  levels  of  system  upon  its  higher  levels.  The 
method,  successfully  used  in  risk  and  reliability  analysis#  can  also 
be  used  to  estimate  probability  of  survival  for  complex  systems  and  to 
compare  various  hardening  approaches,  such  as  tailored  hardening 
versus  shielding.  A  tutorial  on  fault  tree  analysis  appears  in 
Appendix  G.  A  byproduct  of  such  analysis  is  that  weak  spots  in  the 
system  may  be  identified  and  may  serve  as  a  guide  to  engineers  on  what 
needs  hardening.  Another  byproduct  is  the  ability  to  rank  the  various 
subsystems  in  a  system  with  respect  to  their  hardness. 

Thi3  type  of  analysis  has  certain  problems  associated  with  it.  For 
example,  all  the  relevant  modes  of  failure  are  assumed  to  be 
identified.  Implicitly  this  assumption  means  that  the  analyst  does 
not  omit  from  the  model  hidden  weakness#  such  as  human  error  cr 
unusual  failures#  and  that  the  analyst  understands  the  relationship  of 
the  various  parts  of  the  system  well  enough  to  model  them  accurately. 
Thus#  cooperation  between  the  fault  tree  analyst  ana  the  system 
designer  is  essential  for  the  successful  construction  of  a  fault  tree. 

The  simplest  form  of  fault  tree  analysis  assumes  that  each 
component  (or  basic  node)  has  a  known  probability  of  success, 
independent  of  other  basic  nodes.  However#  for  a  sophisticated  system 
one  may  have  to  deal  with  dependencies  by  introducing  conditional 
probability  models  relating  the  dependencies  of  the  failures  at  the 
basic  nodes.  Intimate  knowledge  of  system  dependence  upon  components 
is  necessary  for  this  procedure  to  be  credible.  One  will  certainly 
have  to  deal  with  the  fact  that  many  probabilities  are  not  known  and 
may  have  to  be  estimated  on  the  basis  of  very  few  or  no  data. 

The  last  complication  suggests  that  the  analysis  be  carried  out  in 
a  Bayesian  framework#  which  involves  the  subjective  judgment  of 
engineers  and  the  analysts.  Thus,  for  each  basic  node#  a  posterior 
distribution  of  probability  must  be  obtained  based  on  a  prior 
subjective  judgment  compounded  with  observed  data,  if  any. 
Calculations,  which  are  straightforward  in  principle  but  complex  in 
execution#  will  convert  the  nodal  posterior  distributions  to  a 
posterior  distribution  for  POS.  That  is  to  say#  different  values  of 
POS  will  be  assigned  different  weights. 

Thus  a  fault  tree  analysis  will  yield  a  probability  distribution  of 
the  probability  of  system  survival,  conditional  upon  the  level  of  an 
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imposed  threat.  If  certain  prior  probability  distributions  are 
sufficiently  vague  and  very  few  data  are  available  on  the  related 
components,  the  eventual  distribution  of  POS  may  be  so  broad  as  to  be 
useless  as  a  guide  for  action.  In  that  case  it  may  become  important 
to  invest  in  gathering  more  relevant  data,  if  possible,  or,  if  not,  to 
question  carefully  the  subjective  inputs.  Alternatively,  if  the  prior 
distributions  that  are  assigned  have  strong  influence,  then  expert 
judgment  should  be  used  to  validate  them. 

One  of  the  weaknesses  of  the  above  approach  is  that  if  the 
subjective  prior  distributions  are  not  specified  carefully  and  without 
bias,  the  conclusions  may  be  unduly  distorted  and  misleading.  Thus, 
it  is  desirable  to  develop  methods  of  analysis  that  evaluate  the 
sensitivity  of  the  conclusions  to  variations  of  the  information 
(models,  prior  distributions,  and  data)  on  which  calculations  are 
based.  During  the  analysis  constant  and  unceasing  attempts  must  also 
be  made  to  validate  its  quality  and  the  defensibility  of  the  decisions 
that  result  from  it. 


Applications  to  Some  Other  Statistical  Techniques 

The  distinction  between  objective  and  subjective  probability  is 
blurred  in  most  statistical  practice.  All  statisticians  acknowledge, 
for  example,  that  certain  statistical  models  promise  to  be  useful  in 
certain  circumstances)  for  example,  the  normal  IGaussian)  distribution 
often  describes  measurerent  or  ballistic  errors  reasonably  well, 
whereas  the  exponential  distribution  better  describes  certain  times  to 
failure.  Selection  of  such  models  to  aid  decision  making  i3  certainly 
subjective,  but  such  selection  is  usually  ayreed  to  be  best 
accompanied  by  considerable  attention  to  sensitivity  of  the  decision 
to  overall  model  Inadequacy.  Surprises  that  experts  did  not 
anticipate  will  occur,  and  the  effects  must  be  capitalized  upon  or 
forestalled.  Present-day  attention  to  robust  procedures  (both 
Bayesian  and  frequentist)  has  this  objective.  Subjective  prior 
distributions  for  unknown  quantities  should  be  carefully  checked  for 
their  influence  on  the  final  decision,  especially  if  the  data  are 
sparse  or  negligible. 

Two  further  ideas  may  be  useful  for  BMP  problems.  The  first  idea 
embraces  the  Empirical  Bayes  and  the  Bayes  Empirical  Bayes  methods) 
both  recognize  variability  between  individual  cop'es  of  designs,  be 
they  individual  coins  or  EMP-shielded  systems.  Such  variability  is 
usefully  characterized  mainly  in  terms  of  systematic  explanatory 
variables,  but  additionally  in  terms  of  random  variability  described 
by  a  superpopulation.  Test  results  for  box-level  system  components 
may  well  be  usefully  summarized  in  an  Empirical  Bayes  fashion.  The 
second  idea  is  that  hardness,  or  invulnerability,  may  be  conveniently 
and  usefully  characterized  in  physical  terms,  for  example,  in  terms  of 
margin,  measured  in  decibels  (dB) .  Both  strength  and  stress  may  be 


considered  to  be  randon  variables.  The  'probabilistic*  statements  in 
this  case  are  all  assessments  of  the  uncertainty  with  which  a  safe 
level  of  margin,  such  as  100  dB  over  background,  is  achieved.  The 
notion  of  margin  may  be  more  familiar  than  POS  to  engineers,  and  POS 
may  be  more  useful  to  decision  makers. 


Application  to  Probability  of  Survival 

It  is  not  clear  how  probability  of  survival  was  interpreted  nor  how  it 
was  calculated  in  some  of  the  applications  described  in  presentations 
to  the  committee  (Appendix  B) .  In  those  presentations,  there  seemd  to 
be  much  confusion  with  regard  to  POS.  For  example,  Chodorow  (Appendix 
B,  presentation  on  September  30-October  1,  19S3)  asks,  for  a 
one-of-a-kind  system,  'What  can  I  do  with  POS?“  The  terms  probability 
of  survival,  in  particular,  and  probability,  in  general,  require 
careful  interpretation. 

As  a  hypothetical  example,  what  does  it  mean  to  estimate  that  the 
POS  of  an  aircraft  under  an  EHP  threat  is  0.40?  The  fact  that  the 
hypothetical  0.40  is  an  estimate  suggests  that  the  true  unknown 
probability  being  estimated  is  somewhere  near  0.40.  Just  how  near 
becomes  an  important  question.  Even  if  it  were  granted  that  the  POS 
is  exactly  0.40,  there  still  is  a  problem  of  interpretation.  Does  it 
mean  that,  if  100  such  aircraft  were  flying  when  an  EHP  burst  took 
place,  about  40  of  these  would  survive  to  carry  out  their  function? 

Or  could  this  value  of  POS  be  consistent  with  the  following  scenario, 
where  either  all  or  none  of  the  aircraft  survive?  Suppose  that  the 
POS  is  calculated  assuming  that  with  probability  0.40  the  field 
strength  of  the  EHP  is,  say,  5  kilovolts  per  meter  (kV/m)  and  with 
probability  0.60  it  is,  say,  50  kV/m.  Suppose  also  that  our 
calculations  indicate  nearly  100  percent  as  the  probability  of 
survival  for  the  lower  field  anu  nearly  0  percent  as  the  probability 
of  survival  for  the  higher  field.  Then,  with  probability  0.40,  all  of 
the  aircraft  would  survive  and,  with  probability  0.60,  none  would 
survive.  The  example  also  illustrates  the  need  to  specify  the  POS  as 
a  function  of  the  magnitude  of  the  EHP  attack  for  the  benefit  of  the 
designer,  the  pilot,  and  the  force  commander. 

It  is  clear  from  the  above,  that  for  one-of-a-kind  systems,  POS 
cannot  be  interpreted  as  is  done  in  the  actuarial  sciences,  where  a 
great  deal  of  comparable  survival  data  are  available.  1  ius,  POS 
should  be  cautiously  viewed  as  a  relative  index  of  the  hardness 
capability  of  the  system. 

The  issue  of  relating  POS  to  various  relevant  circumstances  was  not 
clearly  brought  out  in  the  presentations  to  the  committee.  POS  is 
necessarily  conditional,  conditioned  on  a  criterion  threat  level,  the 
number  of  EHP  bursts,  and  other  operational  parameters.  Chapter  2 
notes  the  availability  of  interim  threat  criteria. 

There  is  also  some  question  about  how  one  should  evaluate  hardness, 
as  measured  by  POS,  when  the  results  are  based  on  complex  calculations 
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involving  many  prior  distributions  approximating  subjective  judgments 
and  feelings  that  may  not  be  be  as  consistent  as  theory  demands  them 
to  be.  Ideally,  Bayesian  analysis  should  lead  to  a  realistic, 
trustworthy  probability  distribution  of  POS  values.  If  the 
distribution  is  highly  concentrated  on  low  values,  softness  exists. 

If  it  is  highly  concentrated  on  high  values,  we  have  hardness.  If  it 
is  spread  broadly,  then  there  is  at  least  potential  softness.  In  the 
first  and  third  cases,  the  analysis  may  point  to  weak  spots,  which 
require  hardening.  In  the  second  case,  where  we  have  hardness,  how 
well  can  that  conclusion  be  trusted?  Sensitivity  analysis  will  help 
tell  us,  provided  that  we  trust  the  structure  of  our  fault  tree. 
Suitable  validation  procedures  are  required. 

One  may  argue  that  this  type  of  analysis  is  not  trustworthy  and 
that  quantitative  conclusions  can  easily  mislead  decision  makers,  who 
may  give  undue  weight  to  numerical  values  based  on  questionable 
assumptions.  The  alternatives  seem  to  be  to  use  some  vague  collection 
of  semlquantitative  statements  or  to  reduce  the  conclusions  to  *a  w< 
or  cold  feeling*  about  the  hardness  of  the  system.  It  is  difficult 
see  how  wise  policy  decisions  on  how  much  to  spend  on  hardening  can 
based  on  warm  feelings  alone. 


GENERAL  GUIDANCE  ON  DIFFERENT  KINDS  OF  'STATISTICS* 

In  our  judgment,  it  is  most  important  for  readers  of  this  report  to  be 
clear  about  the  different  roles  played  by  “statistics*  in  the 
following  subjects: 

1.  Statistical  mechanics. 

2.  The  analysis  of  randomized  experiments. 

3.  Reliability  analysis  through  fault  trees. 

4.  The  analysis  of  data  of  experience,  like  climate  and  the  stock 
market. 

5.  Bayesian-based  estimates  of  reliability. 

There  are  circumstances  where  each  is  the  best  that  one  can  do,  but 
what  each  honestly  promises  to  do  is  quite  different.  An  important 
reason  why  we  are  concerned  with  careful  use  of  probability-related 
words  in  connection  with  BMP  is  the  danger  that  a  misused  word  will 
give  rise  to  a  misinterpreted  meaning,  and  thence  to  a  much  greater 
(or  conceivably  much  lesser)  tru3t  in  some  number  than  that  number 
deserves. 

It  is  not  enough  that  the  numbers  that  come  out  of  an  IMP  analysis 
are  as  good  as  is  possible  at  a  particular  time — it  is  essential  that 
the  recipients  of  the  numbers  understand  the  uncertainties  and 
liabilities  that  surround  them.  So  let  us  go  through  the  five  items 
above,  discucslng  their  necessary  assumptions  and  the  amounts  of  trust 
that  their  answers  can  reasonably  bear. 
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Statistical  mechanics,  both  classical  and  quantum,  is  based  upon 
general  theoretical  assumptions,  whose  consequences  have  been  tested 
in  widely  diverse  situations.  If  we  understand  the  physical  processes 
and  characteristics  involved,  the  results  of  statistical  mechanics  are 
as  trustworthy  as  those  of  deterministic  physical  theory. 

When  the  measurements  and  the  imposition  of  treatments  and 
background  conditions  are  dope  with  the  utmost  care,  and  when  the 
assignments  of  treatments  to  experimental  units  is  as  nearly  truly 
random  as  we  know  how  to  make  them,  the  detailed  results  of  randomized 
experiment  are  the  safest  results  we  know  how  to  obtain;  and  if  we  use 
appropriate  statistical  techniques,  the  3ame  is  true  for  the 
summarized  results. 

These  two  illustrations  involve  some  of  the  most  trustworthy 
analyses  that  we  know  how  to  make. 

Fault  trees  have  proved  very  useful  in  studying  and  improving 
reliability.  But  any  numerical  answers  they  provide  are  no  better 
than  the  information  that  went  into  them.  While  they  are  very  useful 
in  helping  engineers  and  scientists  to  think  about  particular 
questions  of  reliability,  their  use  does  not  guarantee  that  their 
users  have  thought  of  all  the  combinations  of  failures  that  could  be 
critical.  Indeed,  experience  suggests  that  this  rarely  happens. 
Sometimes  the  information  put  into  them  about  the  probability  of 
individual  failures  is  based  on  experiment,  or  even  experience.  Too 
often,  of  course,  absent  such  trustworthy  information,  it  has  to  be 
based  on  the  best  skilled  judgment.  It  is  usual  to  treat  individual 
failures  as  independ»r.t— mainly  because  it  is  believed  that  no  one 
knows  better.  All  these  possibilities — unnoticed  combinations, 
judgment  estimates  for  individual  failures,  and  inability  to  allow  for 
correlated  failures — tend  to  make  the  overall  numbers  more  optimistic 
than  they  should  be.  We  should  use  fault  trees  more  widely,  not  only 
because  they  encourage  careful  thought  but  also  because  they  sometimes 
allow  helpful  caeiparisons.  However,  in  so  doing,  we  should  keep  a 
supply  of  large  grains  of  salt  close  at  hand. 

The  analysis  of  data  of  experience,  illustrated  by  the  studies  of 
weather  and  clim'ate  on  one  hand,  and  by  those  of  the  stock  market  on 
another,  has  made  good  use  of  statistical  techniques;  but  again  we  are 
likely  to  have  missed  important  relationships  of  dependence,  both  in 
average  performance  and  in  deviations.  Again  the  use  of  statistical 
procedures  is  usually  the  best  approach  we  have;  again  the  final 
numbers,  though  often  helpful,  are  likely  to  be  over-optimistic,  at 
least  as  far  as  the  width  of  the  remaining  uncertainty.  Again  we 
ought  to  use  such  techniques,  well  sprinkled  with  large  grains  of  salt. 

Bayesian  techniques  are  often  misunderstood  by  the 
non-professional.  Their  results  are  usually  stated  in  terms  of 
posterior  probabilities — which  are  not  thought  by  Bayesian 
statisticians  as  how  frequently  something  will  happen  or  how 
frequently  some  system  will  survive.  The  professional  Bayesian 
understands  his  or  her  techniques  as  ways  to  combine  degrees  of  belief 


about  individual  elements  into  a  degree  of  belief  about  the  system  as 
a  whole.  Not  only  is  such  an  analysis  of  reliability  subject  to  all 
the  defects  just  described  in  connection  with  fault  trees,  but  it 
relies  more  on  individual  judgments  and  conventional  choices  of  prior 
distributions  than  non-Bayesian  fault-tree  analyses — if  such  are 
possible  for  a  particular  system  at  a  particular  date.  Again  they  may 
well  be  the  best  that  can  be  done  for  a  particular  system  at  a 
particular  time,  but  we  must  be  very  careful  to  equip  the  poster ior 
probabilities  thus  obtained  with  oversize  grains  of  salt  and  warning 
about  their  lack  of  a  trustworthy  frequency  interpretation.  He  should 
not  avoid  their  use,  which  may  well  be  essential;  but  we  should  be 
most  careful  not  to  take  their  final  results  as  gospel — neither  as 
written  on  tablets  of  stone  nor  as  reliable  approximations  to 
predicted  frequencies. 

Whatever  approaches  to  a  specific  problem  are  possible,  we  should 
choose  the  most  trustworthy  among  them,  and  use  it.  But  we  dare  not 
misinterpret  its  results. 

Some  use  ’statistics*  as  a  way  of  sanctifying  results.  Accordingly 
we  may  need  to  attach  the  label  ’unsanctified*  as  a  flag  on  results 
obtained  in  ways  widely  different  from  those  which  are  generally 
agreed  to  deserve  the  moBt  trust.  While  views  of  Bayes  techniques 
differ,  most — and  we  believe  most  Bayecians — would  not  feel  that 
either  their  purpose  or  their  functioning  is  one  of  sanctification. 

One  reason  we  have  emphasized  the  need  for  the  involvement  of  mote 
professional  statisticians  in  BMP  activities  is  the  difficultly  of 
pressing  forward  Bayes  techniques,  where  they  are  the  best  we  can  do, 
while  at  the  same  time  avoiding  undue  belief  in  the  numbers  they 
provide  us. 

When  a  quite  uncertain  number  is  the  best  that  can  be  had,  it  may 
be  important  to  get  it  and  important  not  to  throw  it  away — but  even 
more  important  not  to  take  it  too  seriously. 

Since  there  is  no  way  to  base  an  analytical  estimate  of  EMP 
vulnerability  on  first  principles,  there  can  be  no  substitute  for  the 
best  physical  simulations  possible  as  a  route  to  adjust  and  improve 
the  results  of  analytical  studies. 


CONCLUSIONS  AND  RECOMMENDATIONS  CONCERNING  STATISTICS 

The  preceeding  sections  of  this  chapter  draw  a  number  of  conclusions 
in  the  course  of  specific  discussion.  The  principal  ones  are 
recapitulated  here. 

First,  the  statistical  techniques  applied  so  far  in  the  estimation 
of  vulnerability  to  EMP  effects  have  been  straightforward  but  lack  the 
depth  and  sophistication  needed  to  address  many  of  the  key  issues. 
Clarity  is  lacking  in  the  definition  of  key  concepts,  such  as 
probability  of  survival,  and  of  terminology,  such  as  confidence  limits. 
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Second,  the  potential  role  of  statistics  in  EMP  protection  and 
assessment  is  not  merely  central,  but  is  essential  and  inevitable  at 
several  levels  of  the  EMP  problem.  Statistics  is  well  suited  to 
characterize  certain  properties  of  large  populations  of  piece  parts 
and  the  quality  control  of  shielding.  Statistics  can  improve  the 
design  of  tests  and  the  evaluation  of  results  at  both  the  subsystem 
and  system  level.  For  huge  systems  that  cannot  be  tested  as  a  whole, 
certain  statistical  methods  provide  a  framework  for  compounding 
performance  estimates  for  portions  of  the  system  into  performance 
estimates  for  the  whole  system. 

Next,  fault  tree  analysis  may  be  useful  in  comparinq  var tous 
hardening  approaches.  Fault  tree  analysis  may  also  be  a  useful 
approach  to  indicating  the  relative  probability  of  survival  for 
complex  systems.  However,  probability  of  survival  is  not  yet 
adequately  defined  and  interpreted  to  allow  its  use  as  a  firm  measure 
of  vulnerability. 

Also,  situations  that  require  decisions  in  circumstances  where 
there  are  few  experimental  data  and  some  prior  beliefs  sometimes  make 
the  use  of  Bayesian  inference  rather  compelling.  When  Bayesian 
inference  is  used,  however,  it  should  be  subjected  to  critical 
scrutiny,  diagnostic  checks,  experimental  verification  by  testing  of 
subsystems,  and  attempts  to  validate  the  expert  opinions  used. 

Finally,  of  the  various  kinds  of  statistical  approaches  to  a  given 
problem  that  may  be  possible,  we  should  choo3f>  the  most  trustworthy 
among  them  and  use  it.  But  it  is  essential  that  the  users  of  the 
results  understand  the  uncertainties  and  liaDilities  that  surround 
them. 

In  view  of  these  conclusions,  we  make  the  following  recommendations: 

1.  The  EMF  community,  including  its  management,  should  be  better 
educated  ori  the  key  ideas  and  notions  of  statistics  and 
reliability.  Improved  standardization  of  statistical 
terminology  used  by  the  EMP  community  should  be  pursued  in 
order  to  reduce  confusion  with  respect  to  its  interpretation 
and  uses. 

2.  The  government  should  utilize  qualified  and  experienced 
personnel,  well  trained  in  statistics,  to  oversee  contractors' 
bids  and  work  that  involve  statistics. 

3.  Collaboration  among  statisticians,  engineers,  and  physicists 
working  on  the  field  of  EMP  protection  and  assessment  (a  good 
example  being  the  team  of  Alexander,  Enlow  and  Karasciewicz) 
should  be  encouraged.  The  statisticians  on  such  teams  should 
be  well  versed  in  the  latest  techniques  and  developments  in 
statistical  methodologies  and  reliability. 

4.  Contract  specifications  that  may  be  interpreted  to  require 
survival  with  probability  equal  to  one  (that  is,  certainty) 
should  be  avoided.  Such  specifications  can  lead  to 
misunderstanding  and  legal  problems,  as  well  as  to  a  poor 
choice  of  contractors.  We  recommend,  rather,  a  collection  of 
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teste,  such  that  passing  all  will  be  acceptable  as  satisfaction 
of  EMP  requirements. 

Because  fault  tree  analysis  is  a  useful  management  tool,  it 
should  be  utilized  in  EMP  work  where  it  is  applicable.  Both 
empirical  and  theoretical  research  may  be  required  to  tailor 
fault  trees  to  the  particular  needs  of  the  EMP  problem. 

The  Defense  Nuclear  Agency  should  establish  a  number  of 
postdoctoral  fellowships  closely  integrated  with  the  field  of 
EMP  protection  and  assessment.  The  fellowships  could  be 
administered  so  as  to  encourage  interdisciplinary 
collaboration,  attract  new  talent  to  the  field,  and  (supplement 
the  ongoing  programs. 
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CONCLUSIONS  AND  RECOMMENDATIONS 


Estimating  vulnerability  of  systems  to  electromagnetic  pulse  (EMP) 
effects  depends  greatly  on  the  nature  of  the  system.  The  soundest 
results  can  be  obtained  where  stress  within  the  system  is  controlled, 
through  integral  shielding  and  penetration-control  devices,  to  well 
known  values.  In  this  case,  one  can  rely  on  engineering  analysis  and 
systematic  testing  of  a  predominantly  deterministic  nature.  Where 
control  and  knowledge  of  stress,  as  well  as  of  strength,  are  not 
possible  because  of  system  design,  complexity,  or  uncontrolled 
changes,  probabilistic  estimates  become  necessary.  Statistical 
methods  for  estimating  and  combining  uncertainties,  fault  tree 
analysis,  and  Bayesian  inference  may  be  used  to  systematize  the 
estimates  of  vulnerability.  However,  repeated  testing  of  systems,  and 
subsystems,  at  as  high  a  simulated  threat  level  as  possible,  is 
essential  with  this  approach.  Whatever  method  is  used,  the 
uncertainty  of  the  result  should  be  clearly  emphasized  to  decision 
makers  lest  oversimplification  result. 

In  our  charge,  and  in  the  composition  of  the  committee,  there  was  a 
great  emphasis  on  statistical  issues.  The  committee,  through  its 
statistical  panel,  investigated  such  issues  thoroughly.  We  found  that 
in  past  work  rather  unsound  and  vague  statistical  meaning  seems  to 
have  been  given  to  such  key  ideas  as  "probability  of  survival"  and 
"confidence  limits."  Further,  for  systems,  as  opposed  to  components, 
we  do  not  believe  that  reliable  numbers  of  this  sort  can  be  inferred 
statistically  from  the  sorts  of  data  available.  In  spite  of  such 
inability  to  give  unambiguous  results,  statistical  thinking  and 
methodology  must  play  a  primary  role  in  evaluating  the  susceptability 
to  EMP  of  existing  large  systems.  The  reason  is  that  statistics  may 
be  the  most  appropriate  and  available  methodology  when  full-scale 
testing,  redesign,  and  extensive  modification  do  not  seem  possible  for 
systems  like  the  national  telephone  network  and  the  national  power 
grid. 

Confident  assessment  of  the  degree  of  protection  of  most,  if  not 
all,  military  systems  is  contingent  on  a  design  making  the  system 
assessable.  In  assuring  against  failure  or  dysfunction  caused  by  EMP, 
effective  design  and,  especially,  effective  shielding,  together  with  a 
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continual  monitoring  of  the  effectiveness  of  such  shielding,  must  have 
a  primary  role  and  statistics,  a  supporting  role. 

With  these  two  Afferent  perspectives  in  mind,  we  present  our 
conclusions  and  recommendations  in  two  parts — the  first  concerning 
general  conclusions  and  recommendations  on  protection  and  the  second 
concerning  statistical  matters  specifically. 


CONCLUSIONS  AND  RECOMMENDATIONS  THAT  WE  BELIEVE  VITAL 
IN  PRODUCING  ASSESSABLE  MILITARY  SYSTE*1S  PROTECTED  AGAINST  EMP 

No  one  committee  or  study  can  settle  forever  the  most  productive 
course  and  program  to  be  followed  in  assessing  the  degree  of  EMP 
protection  of  assets  vital  to  military  missions.  Therefore,  we 
recommend  a  continuing  program: 

1.  There  should  be  a  continued  reappraisal  of  the  threat,  its 
consequences,  and  the  best  near-term  practices  and  longer-term 
research  needed  for  meeting  It. 

The  heart  of  the  EMP  problem  is  to  ensure  completion  of  necessary 
missions  after  exposure  to  EMP.  Completion  of  missions  obviously 
depends  or.  the  continued  operability  of  mission-essential  systems, 
such  a3  navigational  and  weapons  systems  in  aircraft.  Initiation  and 
completion  ol  missions  will  also  depend  on  proper  functioning  of  some 
communications  and  support  systems.  It  is  essential  that  such 
systems,  subsystems,  and  support  systems  continue  to  function  after 
exposure  to  EMP.  It  is  not  essential  that  the  cost  of  protecting 
nonessential  systems  be  incurred.  Accordingly,  selective  effort  is 
desirable: 

2.  Adequate  analyses  should  be  made  of  what  systems,  subsystems, 
and  support  systems  are  essential  to  completion  of  mission. 

The  two  principal  approaches  to  EMP  protection  are  integral 
shielding  of  a  complete  system  and  tailored  hardening  of  selected 
parts  of  it.  In  the  latter  approach,  these  parts  are  selected  after 
analysis  of  the  stresses  expected  to  be  coupled  into  them.  Some 
problems  can  be  treated  analytically — such  as  the  fields  around 
aircraft,  coupling  to  antennas,  and  some  forms  of  coupling  to  the 
interior  of  an  aircraft.  However,  great  and  continuing  uncertainties 
persist  in  predicting  levels  of  voltage  and  current  on  wires  and  on 
components  m  boxes.  Uncertainties  in  the  damage  thresholds  of 
military  specification  (MILSPEC)  components  persist.  The  question  of 
circuit  upset ,,  short  of  damage,  is  not  well  addressed  by  the  analyses 
of  tailored  hardening.  Finally,  in  systems  protected  by  tailored 
hardening  and  later  tested,  large  deviations  from  predicted  results 
occurred  and  unpredicted  responses  were  noted.  For  these  reasons  the 


tailored-hardening  approach  seems  lacking  botn  in  the  actual  control 
of  protection  and  in  the  assessabllity  of  it.  By  contrast,  shielding 
with  control  of  penetrations  of  the  shield  can  be  simple,  modular, 
standardised,  and  verifiable  by  test.  Reduction  of  EMP-induced 
electrical  stress  inside  the  shield  to  levels  similar  to  those  in 
normal  operation  renders  the  protection  of  the  shielded  unit 
independent  of  minor  variations,  associated  with  manufacturing  and 
maintenance,  in  configuration  and  components.  Consequently  snielding 
is  the  preferred  technique: 

3.  There  should  be  great  emphasis  on  achieving  assessability  by 
promptly  developing  better  and  cheaper  means  for  virtually 
complete  and  effective  shielding  of  systems  essential  to  the 
completion  of  mission,  nils  objective  should  include  a  strong 
emphasis  on  early  use  of  standardized  shielded  boxes 
interconnected  with  optical  fibers. 

The  committee  finds  that,  in  view  of  uncertainties  in  component 
thresholds  and  circuit  analysis,  assessable  means  for  providing 
survivability  must  come  through  testing  to  assure  that  qualifications 
are  met.  Testing  that  demonstrates  the  continued  hardness  of  the 
system  must  also  be  carried  out  because  there  are  always  ongoing 
changes  in  the  system  and  because  even  minor  changes  made  by  naive 
workers  can  reduce  hardness.  In  the  case  of  tailored  hardening, 
testing  must  be  at  or  near  threat  level.  In  the  case  of  virtually 
complete  shielding,  testing  can  be  chiefly  directed  at  continued 
effectiveness  of  the  shielding,  with  high-level  testing  of 
penetrations  only.  Clearly,  testing  is  indispensable: 

4.  There  should  be  a  program  to  study  and  devise  and  evaluate  the 
best  and  most  economical  way  for  continual  testing  to  assure 
the  maintenance  of  hardness. 

A  good  deal  of  material  is  available  on  the  hardness  of  components: 
but  the  statistically  characterized  range  of  hardness  of  particular 
MILSPEC  components  is  large,  the  understanding  of  mechanisms  of 
failure  is  inadequate,  and  at  least  some  statistical  and  test  methods 
that  have  bran  used  are  suspect.  Some  systems  exposed  to  H4P  will  not 
be  completely  shielded.  Thus,  component  failure  needs  study: 

5.  There  should  be  a  better  understanding  of  the  mechanisms  of 
component  failure  and  better  and  more  insightful  component 
tests  and  interpretation  of  test  data. 

Not  only  components  but  also  functional  circuit  aggregations,  or 
’boxes,*  can  be  tested  at  high  levels.  As  in  the  case  of  components, 
the  performance  of  entire  circuits  needs  to  be  well  understood: 


6.  There  should  be  increased  emphasis  on  thoroughgoing  analysis, 
testing,  and  comparison  o^  analysis  with  teut  at  the  level  of 
functional  circuit  aggregations,  or  "boxes. ‘1 

The  assessment  of  EMP  hardness  is  of  necessity  based  upon  the 
prediction  of  the  effect  of  EMP  upon  components,  rubsy stems,  a»»u 
systems.  There  exists  a  variety  of  techniques  *or  making  such 
predictions — for  example,  theoretical  analyses,  tests  I'sing  low-lsvel 
electromagnetic'  fieldc,  and  statistical  inference.  Hovever,  at 
present  the  significance  and  reliability  of  such  predictions  remain 
unclear.  Prediction  and  test  need  to  reinforce  each  others 

**.  A  long-range  program  should  be  initiated  and  directed  toward 
the  systematic  validation  of  prediction  methods.  The  TRESTLE 
and  comparable  high-level  simulators  constitute  a  promising 
avenue  to  that  end.  These  simulators  generate  pulses  that  are 
similar  in  many  ways  to,  but  also  significantly  different  fro*, 
the  expected  EMI'  event.  Important  insights  into  the 
credibility  cf  prediction  methods  themselves  coil'd  be  obtained 
by  employing  these  methods  to  predict  the  response  of 
components  and  systems  to  -he  fields  Known  to  be  prcdu-eo  oy 
tne  simulators  and  by  confirming  those  prediction*  with 
experiments  using  the  simulators. 


CONCLUSIONS  AND  RECOMMENDATIONS  CONCERNING 
STATISTICS  AND  STATISTICIANS 

Statistical  methods  are  difficu’t  to  apply  to  the  assessment  of  the 
effects  of  EMP,  because  the  coupled  stress  (1)  i£  atypical  and  not 
*ell  understood  experimentally  -ud  (2)  may  simultaneously  damage  or 
disrupt  many  systems  elements.  Moreover,  the  lack  r»f  ample  data  under 
the  threat— level  environment  is  a  serious  obstacle  to  the  validity  of 
vulnerability  estimates.  The  popujar  instinct  that  statistical 
methods  should  be  easy  to  apply  derived  from  experience  with  II) 
thoroughly  researched  phenomena  and  {/)  independent  element  failures 
in  a  large  system.  Analagous  statistical  problems  ara  facet  by  t*e 
:;.S.  Nuclear  Regulatory  Commission  in  radittior.  risk  assessment. 
Bayesian  methodology  was  the  dominant  one  used  th^re. 

The  statistics  panel  found  weaknesses  in  the  statistical  work  done 
in  connection  with  EMP.  With  fev  exceptions,  vorK  seams  to  have  beer, 
conducted  by  engineers  or  mathematicians  with  little  or  no  formal 
training  or  practical  experience  in  statistics.  Difficult  but 
important  issues  have  not  been  clearly  articulated  or  understood. 

There  haw  been  evidence  of  confusion — likely  to  lead  to  serious 
misunderstandings — regarding  the  use  of  statistical  terminology  and 
the  use  of  statistical  notions.  Contracting  agencies  have  not  been 
veil  advised  concerning  the  suw Oi  usefulness  of  statistical 


work  laid  out  in  proposals.  Toward  remedying  this  situation,  we 
present  the  following  recommendations: 

1.  The  EOT  community,  including  its  management,  should  be  better 
educated  on  the  key  ideas  and  procedures  of  statistics  and 
reliability.  Improved  standardization  of  statistical 
terminology  used  by  the  EOT  community  should  be  pursued  in 
order  to  reduce  confusion  with  respect  to  its  interpretation 
and  uses. 

2.  The  government  should  utilize  qualified  and  experienced 
personnel,  well  trained  in  statistics,  to  oversee  contractors' 
bids  and  work  that  Involve  statistics. 

3.  Collaboration  among  statisticians,  engineers,  and  physicists 
working  in  the  field  of  EOT  protection  and  assessment  should  be 
encouraged.  The  statisticians  on  such  teams  should  be  well 
versed  in  the  latest  techniques  and  developments  in  statistical 
methodologies  and  reliability. 

4.  Contractual  specifications  that  may  be  interpreted  to  require 
survival  with  probability  equal  to  one  (that  is,  certainty) 
should  be  avoided.  Such  specifications  can  lead  to 
misunderstanding  and  legal  problems,  as  well  as  to  a  poor 
choice  of  contractors.  Me  recommend,  rather,  a  collection  of 
tests  such  that  passing  all  will  be  acceptable  as  satisfaction 
of  EOT  requirements. 

5.  Because  fault  tree  analysis  is  a  useful  management  tool,  it 
should  be  utilized  in  EOT  work  where  it  is  applicable.  Both 
empirical  and  theoretical  research  may  be  requited  to  tailor 
fault  trees  to  the  particular  needs  of  the  EOT  problem. 

6.  The  Defense  Nuclear  Agency  should  establish  a  number  of 
postdoctoral  fellowships  closely  integrated  with  the  field  of 
EOT  protection  and  assessment.  The  fellowships  could  be 
administered  so  as  to  encourage  interdisciplinary 
collaboration,  attract  new  talent  to  the  field,  and  supplement 
the  ongoing  programs. 
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APPENDIX  A 
STATEMENT  OF  TASK 


The  scope  of  the  committee's  task  is  described  in  general  terms  in  the 
contract  between  the  Defense  Nuclear  Agency  and  the  National  Academy 
of  Sciences.  The  relevant  portions  are  excerpted  belowi 

[The  committee  will]  evaluate  the  relevant  assessments,  statistical 
models,  and  empirical  predictions  of  electronic  stress  and  failure 
resulting  from  nuclear  explosions.  One  objective  of  the  study  will 
be  to  determine  the  validity  of  the  statistical  analyses,  models, 
methodologies,  and  forecasting  approaches  in  electromagnetic  pulse 
(EMP)  studies.  Another  is  to  determine  the  range  of  issues  in  the 
area  of  EMP  phenomena  and  countermeasures  and  identify  the  major 
ones. 

Based  on  its  evaluation,  the  committee  will  prepare  a  report  on 
the  level  of  confidence  it  believes  may  be  assigned  to  the 
methodologies  currently  employed  in  determination  of  the  expected 
level  of  EMP  effects  and  the  degree  of  risk  implied  either  by  using 
the  shielding  or  tailoring  approaches  for  protection.  It  will  make 
recommendations  on  research  gaps,  areas  of  uncertainty,  and  needs 
for  further  research.  A  final  report  will  be  produced  at  the  end 
of  the  study. 

To  give  additional  clarity,  structure,  and  specificity  to  the 
general  task,  at  the  first  meeting  of  the  committee  the  sponsor  posed 
six  questions  for  the  committee  to  consider.  Although  the  committee 
was  not  bound  to  develop  exhaustive  answers  to  all  of  the  questions, 
they  nevertheless  were  a  useful  guide  to  its  work.  The  questions  are 
listed  below: 

1.  Based  on  the  "probability  of  survival*  (POS)  approach  to  EMP 
hardness  evaluation  as  it  is  presently  defined  and  employed: 

a.  What  would  be  the  appropriate  terms  for  expressing 
expectations  of  system  hardness/vulnerability  to  EMP? 
(probability  of  survival/confidence?  Go/no-go?  A 
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qualitative  characterization?  other?)  How  do  the 
prospects  Cor  characterization  of  EMP  hardness  relate  to 
DOD  decision  analysis  requirements? 

b.  Is  the  POS  approach  sufficiently  well  defined/documented  to 
allow  an  evaluation  of  its  reliability  or  of  the  risks  of 
reaching  erroneous  conclusions  regarding  system  hardness? 

c.  what  basis  exists  for  the  evaluation  of  reliability/risks 
and  what  reliability /risks  should  be  attributed  to  the  POS 
approach?  Does  the  reliability/risk  depend  upon  system 
features?  If  so,  in  what  way? 

d.  What  are  the  prospects  for  significant  improvement  of  the 
POS  hardness  evaluation  approach  and  what  would  be  involved? 

2.  What  procedures  could  be  employed  to  reliably  evaluate  system 

hardness/vulnerability  to  upset? 

3.  Based  on  the  ’tailored  hardening*  protection  approach  aB 

presently  defined  and  employed: 

a.  What  are  the  appropriate  terms  for  characterizing  one's 
expectations  regarding  the  attainment  of  system  hardness 
and  the  retention  of  hardness  throughout  a  system's  life 
cycle  following  the  introduction  of  tailored  hardening? 

b.  Is  the  tailored  hardening  protection  approach  sufficiently 
well  defined  and  documented  to  allow  an  evaluation  of  its 
effectiveness  and  of  the  risks  of  failure  to  attain  and 
retain  system  hardness  to  EHP? 

c.  What  basis  exists  for  an  evaluation  of  the  effectiveness 
and  the  risks  associated  with  the  application  of  the 
tailored  hardening  protection  approach?  What 
effectiveness/risks  should  be  attributed  to  it? 

d.  What  are  the  prospects  for  significant  Improvement  of  the 
reliability/effectiveness  of  the  tailored  hardening 
protection  approach?  What  would  improvement  entai)? 

4.  Based  on  the  "integral  shield  with  penetration  controls* 

protection  approach  as  presently  defined  and  employed: 

a.  What  are  the  appropriate  terms  for  characterizing  one's 
expectations  regarding  the  attainment  of  system  hardness 
and  the  retention  of  hardness  throughout  a  system's  life 
cycle  following  the  introduction  of  integral  shielding  and 
penetration  controls? 

b.  Is  the  integral  shield  with  penetration  control  protection 
approach  sufficiently  well  defined  and  documented  to  allow 
an  evaluation  of  its  effectiveness  and  of  the  risks  of 
failure  to  attain  and  retain  system  hardness  to  BMP? 
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c.  What  basis  exists  tor  an  evaluation  of  the  effectiveness 
and  the  risks  associated  with  the  application  of  the 
integral  shield  with  penetration  control  protection 
approach?  What  effectiveness/risks  should  be  attributed  to 
it? 

d.  What  are  the  prospects  for  significant  improvement  of  the 
effectiveness  and/or  reliability  of  the  integral  shield 
with  penetration  control  protection  approach?  What  would 
improvement  entail? 

5.  what  can  be  said  regarding  the  relative  effectiveness/reli¬ 
ability  of  the  tailored  hardening  and  integral  shielding  with 
penetration  control  protection  approaches  in  terms  of 
prevention  of  upset?  What  can  be  said  regarding  the  attainment 
and  retention  of  hardness  throughout  a  system's  life  cycle? 

6.  Electrical  overstress  damage  and  upset  threshold  distributions 
appear  to  constitute  a  critical  issue  relative  to  the  validity 
of  EMP  hardness  evaluation  and  protection  approaches.  We 
believe  that  investigation  of  the  prospectB  for  adequate 
knowledge  regarding  threshold  distributions  would  constitute  an 
efficient  route  to  evaluation  of  the  EHP  hardness  evaluation 
and  protection  approaches.  Does  the  National  Research  Council 
agree?  What  should  one  conclude  regarding  the  adequacy  of  the 
present  understanding  of  thresholds  and  the  prospects  for 
acquiring  adequate  information  to  support  confidence  in 
hardness  evaluation  and  system  protection?  What  Information 
requirements  would  have  to  be  met? 


. 


FEBRUARY  2-3,  1983 


EDWARD  3.  CONRAD,  Consultant 

Diversity  of  Viewpoints  on  EMP 
WILLIAM  J.  KARZAS,  K&D  Associates 

HIP  Protection  Approaches  and  Issues 
JERRY  I.  lubell.  Mission  Research  Corporation 
EMP-Induced  Upset 
ROBERT  A.  POLL,  Jaycor 

Electrical  Overstress  Failure 
RICKARD  R.  SCHAEFER,  Jaycor 

HIP  Hardness  Evaluation:  Procedures  and  Issues 
GORDON  K.  SOPER,  Defense  Nuclear  Agency 
Overview  of  EMP  Problems  and  Issues 


APRIL  1-2,  1983 

ROBERT  Carney,  Boeing  Aerospace  Company 
Tailored  Hardening  Approach 
BRONIUS  CIKOTAS,  Defense  Nuclear  Agency 
EMP  and  Systems  Hardening 

ERIK  GRIMMEU4ANN,  Bell  Telephone  Laboratories,  Inc. 

Telephone  Network  Protection 
JAMES  V.  LOCASSO,  Rockwell  International  Corporation 
Comments  on  Threshold  Methodologies 
GENE  E.  MORGAN,  Rockwell  International  Corporation 
EMP  Shielding  and  Penetration  Control  Methodology 
A  Sampling  of  System-Level  Noise  Data 
DAVID  NEVMAN,  Boeing  Aerospace  Company 

A  Statistical  Approach  to  C3  Facility/Network  Survivability 
Assessment 

NICHOLAS  OSIFCHIN ,  Bell  Telephone  Laboratories,  Inc. 

Bell  Labs  Involvement  in  EMP  Programs 


LOUIS  H.  RODDIS,  Energy  Research  Advisory  Board 
EMP  and  the  Civil  Economy 
FAUST  ROSA,  U.S.  Nuclear  Regulatory  Commission 
EMP  and  Commercial  Nuclear  Power  Plants 


MAT  21,  1933 

VINCENT  K.  JCNES,  Science  and  Engineering  Associates,  Inc. 
BMP  Statistical  Analyses 


JUNE  1-2,  1983 

AIR  FORCE  WEAPONS  LABORATORY  PERSONNEL 
Tours  or  EMP  Simulation  Facilities 
JOHN  H.  DARRAH,  Space  Command 

Internal  Coupling  Theory  vs  Experiment 
WILLIAM  GORDON,  Air  Force  Nuclear  Criteria  Group  Secretariat 
The  NCG/NCGS  Story 

TONY  M.  JOHNSON,  Air  Force  Weapons  Laboratory 
Introduction  to  Air  Force  Weapons  Laboratory 
ROBERT  PARKER,  Sandia  National  Laboratory 
Minutr-an  Missile  Hardening  Effort 
PAUJ  KYI  (also  known  as  CHRIS  ASHLEY),  Albuquerque,  New  Mexico 

Some  Remarks  on  Assessing  the  EMP  Reliability  of  Military  Systems 
EDWARD  F.  VANCE,  SRI  International 
EMP  Coupling  to  Long  Lines 


JUNE  3,  1983 

DAVID  R.  ALEXANDER,  Mission  Research  Corporation 

Overview  of  the  Component  Statistical  Characterization  Program 
EDWARD  W.  ENDOW,  BDM  Corporation 

Review  of  Testing,  Data  Storage,  and  Retrieval  Procedures 
RICHARD  A.  HAYS,  Air  Force  Weapons  Laboratory 

The  Component  Statistical  Characterization  Program 


AUGUST  9-10,  1983 

EDWARD  BEDROS; ‘ v ,  Rand  Corporation 

High-Altitude  Electromagnetic  Pulse— System-Relevant  Issues 
and  Recommendations 

HRIAR  S.  CABAYAN,  Lawrence  Livermore  National  Laboratory 
High-Altitude  EMP  (HEMP)  Effects  Studies  Program  Flan 


LENNART  HAP.IN,  Dikewood  Corporation 
EMP  Teats  on  E-2  Aircraft 

RICHARD  W.  HENSING,  Lawrence  Livermore  National  Laboratory 
HER?  Vulnerability  Assessment  Methodology 
STEPHEN  M.  YOUNGER,  Lawrence  Livermore  National  Laboratory 
High-Altitude  EMP  Environment  Codes 


SEPTEMBER  30 -OCTOBER  1,  1983 

LEW  ALLEN,  JR.,  Jet  Propulsion  Laboratory 
Welcome  to  Jet  Propulsion  Laboratory 
ALAN  M.  CHODOROW,  Mission  Research  Corporation 

EMP  Hardening  and  Validation  for  Ground  Based  C3  Facilities 
CONRAD  1*.  LONGMIRE,  Mission  Research  Corporation 

High' Altitude  EMP  Generation  and  Coupling — Variability 
and  Effect  on  Vulnerability  Assessments 
JAMBS  R.  VAN  ZANDT,  MITRE  Corporation 
EMP  Protection  of  the  E-4B 


APPENDIX  C 

ELECTROMAGNETIC  PULSE  COUPLING  PHENOMENA 


Electromagnetic  (EM)  coupling  of  an  external  field,  such  as  an 
electromagnetic  pulse  (EMP) ,  to  circuits  and  circuit  elements  inside 
an  enclosed  system  takes  place  through  intentional  penetrations  such 
as  antennas  and  waveguides.  In  addition  there  usually  are  present 
many  inadvertent  EM  coupling  paths  through  elements  such  as  cables, 
apertures,  and  grounding  loops.  While  designed  to  handle  the  normal 
signal  and  noise  background  adequately,  a  system  subjected  to  EMP  may 
be  caused  to  malfunction  by  spurious  signals  introduced  through  these 
penetrations  and  inadvertent  coupling  paths.  Analyzing  and  predicting 
inadvertent  coupling  for  the  purpose  of  assessing  and  protecting  a 
complex  system  has  historically  been  and  still  is  a  difficult  and 
challenging  task. 


ANALYTICAL  APPROACH 

While  in  principle  an  arbitrarily  accurate  analysis  of  the  EM  coupling 
can  be  derived  by  solving  the  Maxwell  equations  in  the  context  of  a 
bound ary- value  problem,  in  reality  even  for  a  relatively  simple  system 
a  classical  deterministic  approach  often  demands  more  effort  and 
resources  than  are  available.  To  keep  the  mathematics  tractable, 
judicious  use  of  approximations  and  engineering  judgments  is 
inevitably  required.  Even  so,  the  effort  presently  needed  to  obtain 
approximate  deterministic  predictions  for  EM  coupling  to  complicated 
systems  is  still  substantial  (Baum,  1976) . 

As  in  many  complicated  problems  attempts  are  made  to  simplify  the 
analysis  by  considering  small  subproblems  that  can  be  treated 
independently  (Tesche,  1978) .  The  total  solution  to  the  main  problem 
is  then  looked  upon  as  a  combination  of  such  solutions.  In  the  area 
of  eMP,  one  can  divide  the  analysis  of  a  particular  system  into  the 
following  subareas: 

1.  Study  of  the  production  of  EMP  (EHP  phenomenology) . 

2.  Propagation  of  EMP. 

3.  Interaction  of  EMP  with  the  exterior  of  the  system  (external 
interaction) . 
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4.  Coupling/  propagation,  and  penetration  of  energy  within  the 
system  (internal  interaction) . 

6.  Transient  analysis  of  driven  circuits  within  the  system. 

6.  Overall  system  assessment. 

This  appendix  is  concerned  mainly  with  points  3  and  4. 

In  many  instances,  the  analysis  of  each  subproblem  is  unrelated  to 
the  others,  except  of  course  for  the  excitation  of  one  subproblem  by 
another.  In  some  cases,  however,  there  may  be  more  complex 
interactions  between  one  subproblem  and  another.  For  example,  if  an 
aperture  becomes  too  large,  the  interaction  between  the  inferior  and 
exterior  boundary  value  problems  becomes  such  that  they  must  be 
examined  together.  In  general  the  decoupled  deterministic  method  of 
analysis  is  reasonably  accurate. 


EXTERNAL  INTERACTION 

Macroscopic  systems  such  as  aircraft,  satellites,  and  missiles 
generally  have  a  complete  or  nearly  complete  metallic  shell  covering 
that  serves  as  a  shield  from  electromagnetic  fields.  The  modes  of 
field  penetration  are,  for  example:  (1)  the  propagation  through 
windows  and  holes  in  the  metal  covering,  through  joints  in  the  metal 
skin,  through  cracks  around  access  doors,  and  through  exhaust  ports; 

(2)  the  direct  excitation  of  electrical  cabling  that  is  run  outside 
the  metallic  covering  over  a  portion  of  the  surface  and  then  run 
inside  to  some  internal  component;  and  (3)  the  direct  excitation  of 
system  antennas  (Taylor,  1978).  For  the  foregoinq  examples  the  amount 
of  current  or  voltage  induced  in  a  system  element  at  a  given  frequency 
is  directly  related  to  the  external  electric  and/or  magnetic  field, 
provided  no  nonlinear  responses  are  excited.  Thus  the  system  elements 
are  reasonably  well  decoupled  from  the  EMP,  and  the  deterministic 
method  of  analysis  should  yield  accurate  results. 

The  EMP  coupling  to  an  electric  system  inside  a  structure  such  as  a 
building  may  not  be  so  easily  analyzed,  since  it  may  not  be  assumed 
that  the  system  is  protected  by  an  exterior  electromagnetic  shield. 
However,  certain  buildings  do  possess  a  reinforcing-bar  network  that 
may  act  as  a  partial  screen  to  electromagnetic  fields.  Unfortunately 
this  screen  is  usually  not  sufficient  to  make  the  external  fields 
independent  of  the  Interior  system.  What  this  means  in  terms  of 
analysis  is  that  the  response  of  an  interior  component  must  be 
determined  by  considering  the  interaction  of  the  total  system  as  a 
whole  rather  than  as  separable  info  external  and  internal  regions. 

If  the  electrical  system  under  consideration  is  shielded  by  a  metal 
covering,  then  the  electric  and  magnetic  fields  on  the  external 
surface  are  essentially  given  by  the  surface  current  density  (sources 
of  magnetic  field)  and  surface  charge  density  (sources  of  electric 
field)  that  would  exist  if  the  metal  covering  were  a  perfect 


conductor.  These  are  obtained  by  solving  a  system  of  partial 
differential  equations  (Maxwell's  equations)  or  by  solving  the 
equivalent  vector  wave  equations.  In  general,  exact  analytical 
solutions  have  limited  application  because  of  the  complex  geometry  of 
typical  structures. 

Approximate  analytical  solutions  have  a  broader  range  of 
application  than  exact  solutions.  In  the  low-frequency  regime 
(wavelength  greater  than  characteristic  dimensions  of  the  structure) 
the  quasistatic  approximation  is  quite  useful  (Taylor,  1973;  Tesche, 
1971;  Liu  et  al. ,  1975).  At  high  frequencies  the  physical-optics 
approximation  yields  good  results  (Lentz  et  al.,  1972).  This 
technique  is  particularly  advantageous  because  it  can  be  applied  to 
any  geometrical  configuration  without  difficulty.  A  more  accurate 
high-frequency  approximation  is  obtained  by  using  the  geometrical 
theory  of  diffraction  (Lentz  et  al. ,  1972;  Tsai  et  al.,  1972). 

All  the  aforementioned  techniques  are  limited  to  simple  geometries 
by  practical  considerations.  Thus  modeling  techniques  are  required 
for  treating  realistic  geometrical  configurations.  For  example,  a 
model  for  a  missile  might  be  a  body  of  revolution  or  a  right  circular 
cylinder.  A  rectangular  parallelepiped  or  even  a  sphere  might  be  used 
to  model  a  metal  building. 

For  geometrically  simple  structures  the  existing  theoretical  moa _ 

yield  sufficiently  accurate  results  in  predicting  the  external 
coupling  to  the  BMP.  For  the  more  complex  structures,  such  as 
aircraft,  the  theoretical  model  results  may  differ  as  much  as  6 
decibels  (dB)  from  the  measured  skin  currents  and  charge  densities. 
Perhaps  more  accurate  results  could  be  obtained  by  using  a  fine 
three-dimensional  wire-mesh  model  or  by  solving  a  three-dimensional 
integral  equation  for  the  surface  current  density. 

The  coupling  of  EMP  to  power  transmission  lines  has  been  analyzed 
(Scharfman  et  al.,  1978)  using  a  low  frequency  version  of  Sunde's 
theory  (Sunde,  1949).  The  model  takes  into  account  the  effects  of 
soil  conductivity,  polarization,  line  height,  EMP  pulse  shape,  and 
direction  of  arrival.  Experimental  work  has  shown  the  model  to  be 
accurate  enough  that  more  complex  analytical  techniques  are  not 
required.  Effects  of  transformers  and  lightning  arresters  have  also 
been  analyzed.  Coupling  to  telephone  lines  has  been  successfully 
analyzed  in  similar  ways. 

The  general  problem  of  EMP  coupling  through  cable  shields  is  fairly 
well  understood  (Casey  and  Vance,  1978).  The  coupling  mechanisms 
involved  are  known,  and  in  many  specific  cases  (for  example,  small 
holes  in  the  shield)  the  effects  of  coupling  on  the  internally 
propagating  signals  are  amenable  to  exact  analytic  determination. 
Specific  features  of  the  braided-shield  coaxial  cable  have  been 
studied:  these  include  the  anisotropic  conductivity  of  the  braid, 
apertures  in  the  braid,  and  effects  of  the  dielectric  jacket. 

H4P  coupling  to  buried  cables  and  other  buried  penetrations,  such 
as  drain,  sewer  pipes,  and  power  leads  to  outside  lights,  has  also 
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been  analytically  modeled.  Scale  model  tests  have  been  conducted. 
Problems  presented  by  these  types  of  penetrations  are  generally  much 
smaller  than  those  previously  discussed. 

The  direct  excitation  of  system  antennas  by  BMP  has  been  studied 
for  both  in-band  and  out-of-band  response.  These  studies  have 
included  various  types  of  airborne  and  grounded  antennas,  connecting 
transmission  lines  (coaxial  and  wave-guide)  and  antenna  towers. 
Analytical  techniques  in  these  areas  are  well  developed  and  their 
accuracy  is  very  good. 


INTERNAL  INTERACTION 

Much  effort  has  been  expended  in  trying  to  understand  EMP  phenom¬ 
enology  and  propagation.  A  similar  statement  can  be  made  about  the 
external  interaction  and  circuit  areas.  Although  some  effort  has  also 
been  spent  in  developing  the  sophistication  of  the  analytical  tools  in 
the  internal  interaction  area  (Tesche,  1978),  it  is  generally  agreed 
that  the  highest  uncertainty  exists  in  this  area  (Baum,  1974;  A ' . 

Force  Weapons  Laboratory,  1972) . 

Often  the  terms  "interaction*  and  "coupling*  are  used  synony¬ 
mously.  There  is,  however,  a  substantial  difference  between  internal 
coupling  and  internal  interaction,  both  of  which  will  be  discussed 
below.  Note  that  this  distinction  will  hold  fcr  both  internal  as  well 
as  external  problems. 

The  area  of  internal  interaction  begins  at  the  skin  of  the  system 
(aircraft,  for  example)  and  treats  the  radiation  and  propagation 
within  the  confines  of  the  system.  Thus  it  is  presumed  that  the 
exterior  interaction  problem,  as  well  as  the  penetration  problem 
through  the  aircraft  skin,  has  already  been  solved.  Quantities  of 
interest  to  be  determined  in  an  internal  interaction  calculation  are 
the  transfer  functions  from  specified  input  ports  to  the  critical 
electronic  components  within  the  system. 

Consider  a  simplified  internal  interaction  problem  of  a  cable 
located  inside  a- perfectly  conducting  shield  having  an  aperture.  It 
is  assumed  that  the  external  problem  has  been  solved,  and  sufficient 
information  is  available  to  determine  the  aperture  field  distribu¬ 
tions.  The  steps  in  carrying  out  the  internal  interaction  analysis 
are  as  follows: 

1.  With  the  solution  of  the  exterior  problem  and  knowledge  of  the 
equivalent  sources  in  the  aperture(s)  that  radiate  into  the 
interior  region  of  the  shield,  compute  the  fields  exciting  the 
cable.  This  procedure  is  referred  to  as  determining  the 
"coupling"  of  the  EMP  energy  to  the  cable  and  results  in  a 
knowledge  of  the  local  voltage  and  current  sources  exciting  the 
cable. 

2.  Knowing  these  local  cable  sources,  determine  how  they  excite 
currents  throughout  the  cable.  This  calculation,  which  also 


gives  the  distribution  of  charges  on  the  cable  as  its  most 
important  result,  is  called  the  "internal  propagation" 
calculation.  The  calculation  usually  involves  the  use  of  the 
transfer -function  concept,  which  will  be  discussed  later. 

3.  With  a  knowledge  of  the  charge  distribution  on  the  cable, 
determine  how  the  fields  penetrate  through  the  cable  shield, 
thereby  exciting  additional  wires  within  the  cable  sheath. 

Such  a  "penetration"  problem  thus  serves  as  a  starting  point 
for  another  internal  interaction  calculation  performed  in  a 
smaller,  better  shielded  region  inside  the  cable. 

Thus  the  internal  coupling  problem  is  a  subset  of  the  interaction 
problem  and  involves  only  the  determination  of  local  sources — not  the 
solution  of  the  propagation  and  penetration  problems. 

Following  the  notion  of  noninteraction  between  subproblems,  the 
usual  approach  for  treating  the  internal  interaction  problem  is  to 
define  transfer  functions  that  relate  the  frequency-domain  voltages  or 
currents  at  the  inputs  to  the  various  circuits  to  the  excitations  of 
the  interior  regions  of  the  system.  These  excitations,  found  as 
outputs  from  the  external  interaction  problem,  are  usually  the 
equivalent  aperture  electric  and  magnetic  dipole  moments  caused  by  the 
fields  passing  through  apertures  or  similar  breaks  in  the  shielded 
enclosure  of  the  system.  Considering  a  system  with  n  ports  of  entry, 
it  is  possible  to  define,  for  each  port,  a  pair  of  excitation  terms 
given  by  Pi(a)>  and  Mi(co),  which  are  the  equivalent  complex 
electric  or  magnetic  dipole  moments  of  the  ith  port  of  entry  as 
functions  of  angular  frequency,  0).  In  the  most  general  type  of 
aperture  both  terms  will  exist,  but  there  may  be  special  cases  where 
either  one  or  the  other  type  of  dipole  moment  is  negligible.  Note 
that  these  individual  dipole  moments  are  themselves  vector  quantities. 

The  propagation  of  energy  from  these  input  ports  to  the  various 
internal  circuits  occurs  principally  via  transmission  lines,  although 
transmission  line-like  structures,  such  as  hydraulic  lines,  c«#n  also 
guide  energy  within  the  confines  of  a  large  system.  The  reponse  at  a 
particular  circuit  with  the  system,  let  us  say  at  the  pin  of  a 
connector,  can  be  evaluated  if  the  open  circuit  voltage  and 

the  impedances  of  the  circuit  and  the  feeding  transmission  line 
network  are  known. 

The  relationship  between  the  open  circuit  voltage  of  a  particular 
pin  and  the  external  excitation  is  given  generally  by 
n  _  _ 

V  (0J>  ■  £  (COI-T  <W>  +  T  (u)->f Au).  (1) 

°C  i,1  Ei  1  Ml  1 

where  T  and  T  are  complex  vector  transfer  functions  that  relate  the 
Ei  Mi 

excitation  at  the  ith  aperture  to  the  voltage  at  the  terminals  under 
consideration.  These  transfer  functions  contain  results  of  both  the 
internal  coupling  and  internal  propagation  analyses.  The  basic 
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problem  In  the  Internal  interaction  area,  therefore,  is  to  define 
accurately  the  elements  of  the  transfer-function  vectors  in  (1). 

At  present,  there  exist  many  difficulties  in  defining  the  elements 
of  the  parameters  in  (1).  These  difficulties  stem  from  not  having 
sufficient  theoretical  or  numerical  analytical  methods  to  obtain 
parameters  for  the  various  coupling,  propagation,  and  penetration 
models.  Additionally,  the  possible  inapplicability  of  some  of  the 
models  may  oversimplify  the  problem. 

Because  transmission  line  propagation  is  the  most  important 
mechanism  for  guiding  BMP  energy  within  the  internal  regions  of  a 
system,  the  determination  of  the  transfer  functions  and  T^ia 
often  accomplished  using  conventional  transmission  line  analysis 
procedures.  The  geometry  of  the  internal  region  is  simplified  in  the 
vicinity  of  the  transmission  line;  and,  in  most  circumstances,  a 
complex  multiwire  transmission  line  is  modeled  as  a  single  wire 
transmission  line  (Carter  and  Curtis,  1974) . 

In  some  instances,  where  a  uniform  transmission  line  model  is  not 
applicable  because  of  rapid  variations  of  the  transmission  line 
geometry,  the  use  of  the  lumped  parameter  model  (LPM)  (Air  Force 
Weapons  Laboratory,  1972)  of  the  transmission  line  is  possible.  This 
approach,  however,  requires  much  computer  storage  and  is  not 
particularly  useful  for  the  analysis  of  large  transmission  line 
networks. 

The  use  of  general  multiconductor  transmission  line  analysis  for 
internal  interaction  problems  has  been  discussed  by  some  investigators 
(Frankel,  1974;  Paul,  1974)  for  a  single  section  of  a  multiconductor 
transmission  line  model,  including  branching  and  closed  loops.  With 
this  more  detailed  approach,  the  transfer  functions  of  (1)  can  be 
evaluated  more  accurately,  thereby  providing  a  more  accurate  solution 
to  the  entire  BMP  interaction  problem. 

The  analysis  of  EMP  internal  coupling  to  critical  electronic 
components  and  subsystems  is  complicated  by  the  presence  of  many 
seemingly  random  parameters,  such  as  the  relative  positions  of  bunched 
cables  near  points  of  entry  and  the  random  positions  of  conductors  in 
K-vire  lines.  These  random  parameters  make  the  deterministic  solution 
for  6M?-induced  excitations  at  particular  load  points  discussed  above 
very  difficult.  One  can,  of  course,  choose  to  analyze  a  single 
deterministic  "average  model"  of  the  system  in  the  hope  that  the 
excitations  obtained  will  Indicate  expected  excitations  on  any  of 
several  randomly  different  actual  systems.  If  the  random  parameters 
strongly  affect  the  coupling  to  certain  critical  system  points,  the 
actual  excitations  may  differ  vastly  from  the  deterministic  model 
predictions.  A  statistical  analysis  could  then  be  performed  to  obtain 
a  valid  range  of  expected  excitations. 

A  basic  method  for  the  statistical  analysis  of  load  excitations  on 
an  unshielded  N-wire  random  cable  illuminated  by  an  incident 
monochromatic  field  has  been  developed.  The  technique  utilizes  the 
concepts  of  time-harmonic  electromagnetic  field  reciprocity  and 


statistical  representation  of  an  ensemble  by  a  subset.  Although 
restricted  to  a  limited  class  of  structures  (for  example ,  unshielded, 
unbranched,  N-wire  cables) ,  the  method  should  be  extendable  to 
shielded  and  branched  cables  as  well.  In  addition,  it  may  be  possible 
to  conduct  a  direct  time-domain  analysis  via  Welch's  reciprocity 
theorem  (Welch,  1960) . 


COMPUTATION  CODES 

Numerous  computer  codes  are  available  for  analysis  of  EMP  interaction 
and  coupling  problems  (Bevensee  et  al.,  1978).  Most  of  the  codes  are 
based  on  integral  realizations  of  Maxwell's  equations  and  moment 
method  solution  schemes  (Harrington,  1968).  The*#  methods  without 
exception  require  spatial  discretization,  frequency  or  temporal 
discretization,  and  computer-aided  solutions  of  a  large  number  of 
coupled  equations.  As  a  result,  sampling  restrictions  and  computer 
speed  and  storage  requirements  do  not  vary  significantly  from  one  code 
to  another.  In  addition,  accuracy  and  field  anomaly  considerations 
apply  generally.  Types  cf  codes  include  the  following: 

1.  Thm-wire  frequency-  and  time- domain  codes  applicaole  to 

antenna 

responses,  bulk  current  predictions,  and  wire  grid  responses. 

2.  Surface  codes  including  ones  for  bodies  of  revolution  in  the 
resonance  regime,  arbitrary  surface  codes,  and  hybrid  codes. 

3.  General  theory  of  diffraction  codes  for  computing  surface 
currents  in  the  EMP  spectral  range. 

4.  Aperture  codes. 

5.  Shielded  cable  codes. 

Unfortunately,  there  exists  no  code  that  is  applicable  to  all  EMP 
coupling  problems,  so  for  many  applications  it  is  necessary  to  modify 
an  existing  code  or  write  a  new  one.  Recent  trends  m  coae  develop¬ 
ment  will  alleviate  part  of  this  problem.  There  are  codes  under 
development  that  will  eventually  result  m  centrally  maintained, 
general  purpose  EM  codes  applicable  to  a  wide  class  of  EMP  problems. 
However  many  problem  areas  will  persist.  Physical  moaelinq,  error 
estimation,  computer  storage  and  timing  requirements,  and  noa-linear 
considerations  are  the  most  prevalent  ones. 

STATUS 

To  summarize  briefly,  EMP  coupling  is  well  understood  and  accurately 
modeled  for  such  simple  cases  as  antennas,  single  cables,  and  simple 
geometrical  shields.  However,  for  complex  cases,  such  as  large  ground 
facilities  and  aircraft  naving  multiple  critical  systems  and  extensive 
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interconnecting  cabling/  existing  modeling  and  analysis  technology  is 
not  sufficient.  Predicted  voltages  and  measured  voltages  often  differ 
by  amounts  tanging  up  to  20  dB  either  way.  These  uncertainties 
increase  the  difficulties  of  estimating  vulnerability  to  EMP  effects. 
Thus  testing,  using  threat-level  EMP  simulators,  is  currently  required 
for  the  entire  facility  or  aircraft,  where  possible. 
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CLASSES  OF  ACCEPTABLE  PERFORMANCE  FOR 
"  RESISTANCE  TO  ELECTROMAGNETIC  PULSE 


This  appendix  addresses  the  issue  of  damage  and  upset  responses  of 
systems  and  subsystems  that  may  have  varying  degrees  of  criticality  in 
performance  of  a  mission  and  varying  degrees  of  tolerance  to  temporary 
outage. 


DAMAGE  VERSUS  UPSET 

Several  times  in  the  course  of  presentations  to  the  committee  the 
subject  of  damage  versus  upset  was  raised.  Several  briefers  pointed 
out  the  increased  difficulty  in  protecting  against  upset  because  of 
its  lower  thresholds  relative  to  damage.  It  is  important  to 
understand  what  one  means  by  upset.  Two  categories  of  upset  may 
occur,  which  should  be  considered  separately. 

The  first  category  of  upset  involves  precipitous  actions  (for 
example,  releasing  a  weapon)  caused  by  erroneous  states  induced  by  the 
stress  of  electromagnetic  pulse  (EMP)  in  logic  or  other  electronic  or 
electromechanical  elements  of  a  system  or  subsystem.  This  category 
can  be  characterized  by  the  instantaneous  or  nearly  instantaneous 
consequences  of  temporary  EMP  disturbances.  After  the  EMP  has  passed, 
the  disturbed  electronic  or  electromechanical  elements  are  assumed  to 
resume  completely  normal  operation;  but  some  significant  undesirable 
action  has  occurred  because  of  the  disturbance  caused  during  the  EMP 
event. 

The  second  category  of  upset  involves  the  disturbance  of  stored 
states  in  an  electronic  or  other  memory,  such  as  random  access  memory, 
hardwired  logic,  tape,  and  disc.  This  disturbance  results  in 
erroneous  information  stored  in  that  memory  after  an  EMp  event. 
Presumably,  this  erroneous  information  results  in  undesirable  actions 
at  a  future  time,  such  as  loss  of  navigational  capability  or  failure 
of  a  system  containing  the  memory  to  respond  normally  when  activated. 

The  difference  between  these  two  types  of  upset  is  important  for 
two  reasons.  First,  devices  that  store  information  are  relatively 
easy  to  shield  against  EMP  because  they  can  be  physically  confined  to 
a  small  volume  of  a  large  system  and  because  they  can  be  carefully 
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shielded  with  controlled  shield  penetrations  (for  example,  fiber  optic 
input-output).  Further,  it  should  be  relatively  easy  to  standardize 
on  a  small  number  of  approved  memory  technologies  for  critical 
applications.  Secondly,  those  mission-critical  system  elements  (not 
necessarily  containing  memory)  that,  if  disturbed,  will  lead  to 
instantaneous  or  nearly  instantaneous  disaster  should  be  identified 
and  protected  more  carefully  than  less  critical  system  elements. 

These  arguments,  initially  concerned  with  the  subject  of  damage 
versus  upset,  lead  to  the  following  thoughts  on  classes  of  acceptable 
response  and  their  associated  protection. 


CLASSES  OF  ACCEPTABLE  ELECTROMAGNETIC  PULSE  RESPONSE 

Since  there  seems  to  be  a  hierarchy  of  mission-affecting  elements  in 
any  system  (where  the  most  mission-critical  elements  tend  to  be  fewer 
in  number),  there  also  appears  to  be  some  merit  in  establishing  a 
hierarchy  of  acceptable  EMP  responses.  The  most  demanding  elements 
are  those  whose  disturbance  causes  immediate  catastrophe  because 
actions  are  precipitated  which  are  themselves  catastrophic.  Examples 
might  include  weapon  actuators  or  the  terrain-following  navigation 
system  of  low-flying,  high-speed  aircraft.  Subsystems  in  this 
category  might  be  individually  identified  and  hardened  (by  design  or 
overbuilt  protection)  to  resist  EMP  at  all  times — even  during  the  EMP 
event.  Less  critical  elements  might  be  allowed  to  assume 
malfunctioning  states  during  an  EMP  event,  but  be  required  to  return 
to  working  condition  within  a  specified  recovery  interval  (say,  1 
millisecond)  without  manual  intervention.  Still  less  critical 
elements  might  be  allowed  to  assume  malfunctioning  states  requiring 
manual  reset,  provided  that  they  can  be  quickly  diagnosed  as 
malfunctioning.  Finally,  some  noncritical  elements  might  be  allowed 
to  fail  by  reason  of  damage,  thus  requiring  physical  repair  or 
replacement. 

The  reasoning  behind  this  proposed  set  of  EMP  response  classes  is 
the  presumption  that  the  most  critical  mission  elements  are  fewer  in 
number  and  easier  to  protect.  For  example,  the  most  susceptible 
entities  in  an  airplane  might  be  long  metallic  conductors  carrying 
power.  However,  critical  electronic  entities  on  the  airplane  should 
be  relatively  easy  to  isolate  from  the  main  power  buses  and  should 
have  enough  capacitive  storage  to  "ride  out"  an  EMP  disturbance,  even 
if  the  power  buses  themselves  were  briefly  out  of  service  (for 
example,  shorted  by  protection  devices) .  Thus  the  power  buses  would 
merit  a  different  class  of  protection  than  the  subsystems  they  power. 

The  value  of  this  approach  to  classes  o I  EMP  protection  is  the 
avoidance  of  a  possibly  unnecessary  brute  force  approach,  wherein  all 
system  elements  are  treated  equally  at  the  coot  of  less  protection  for 
critical  elements  and  an  overpessimistic  assessment  of  the  feasibility 
of  tailored  hardening  approaches. 


APPENDIX  E 

STATISTICAL  ISSUES  ARISING  IN  THE 
ASSESSMENT  OF  THE  EC-135  AIRCRAFT 


This  appendix  comments  on  statistical  procedures  used  in  the 
electromagnetic  pulse  (EMP)  assessment  of  the  EC-135  aircraft.  In 
particular,  this  material  is  based  to  a  considerable  degree  on  a 
reading  of  a  report  by  Ashley  and  Locasso  (1977) ,  which  discusses  the 
algorithm  used  to  determine  the  reliability  or  confidence  of  the  EMP 
margin  of  the  EC-135.  Related  reports  on  assessment  of  the  EC-135 
were  also  examined.  Discussion  with  Ashley  (also  known  as  Paul  Ryl) 
and  Locasso  was  also  helpful. 


BASIC  SETUP  FOR  EC-135  ASSESSMENT 

At  the  time  the  EC ~13 5  assessment  was  carried  out,  in  the  1970s,  the 
EC -135  fleet  was  planned  to  contain  12  individual  aircraft.  These 
aircraft  were  not  all  the  same;  that  is,  they  were  not  all  constructed 
to  an  identical  design.  In  fact,  some  were  designated  EC-135C  and 
others,  EC-135G. 

One  aircraft  copy  from  the  above  collection  was  selected  for 
assessment.  It  is  not  clear  how  the  initial  selection  was  made;  but 
presumably  every  attempt  was  made  to  obtain  a  representative,  if  not  a 
"random",  example. 

The  entire  aircraft  was  tested  at  an  EMP  test  bed  under  simulated 
conditions;  in  particular,  pulse  values  were  much  lower  than  actual 
real-life  values  are  believed  to  be.  The  aircraft  was  tested  under 
various  orientations,  but  an  attempt  was  made  to  pick  worst-case 
situations. 

Apparently  the  aircraft  selected  was  viewed  as  a  collection  of  28 
potentially  mission-critical  (sub) systems  for  EMP  vulnerability 
assessment  purposes.  (Henceforth  the  term  "sub"  is  dropped  while 
discussing  the  individual  aircraft.)  Each  system  was  in  turn  made  up 
of  a  varying  number  of  boxes,  each  of  which  in  turn  consisted  of  a 
number  of  components — for  example,  semiconductors--*wired  together  into 
functional  circuits.  Boxes  were  interconnected  by  cables  containing  a 
number  of  wires,  and  cables  joined  boxes  by  means  of  plugs. 
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Individual  semiconductors  were  joined  by  wiresf  which  entered  their 
respective  boxes  through  cables  and  plugs. 


THRESHOLDS  AND  STRESSES 

EMT  is  a  threat  because  it  may  induce  large  currents  on  wires  leading 
to  components.  The  result  may  be  failure  of  the  aircraft  to 
function:  either  temporary  failure,  by  "upset",  or  permanent  failure, 
oy  "burnout".  Resistance  to  failure  is  termed  hardness. 


Thresholds 

Component  burnout  (or,  more  generally,  f£ilure)  occur a  if  an  applied 
current,  reaching  the  component  through  a  wire,  exceeds  a  qiven  value 
called  a  threshold  current.  This  statement  is  simplistic,  but  it  is 
correct  enough  for  the  present  purpose.  The  relationships  relating  to 
semiconductor  geometry  and  to  other  factors  besides  electric  current 
aro  wrapped  up  in  the  constants  in  Wunsch'n  Law  (Wunsch  and  3ell, 

1?68)  or  codifications  thereto.  Wunsch' s  Law  states  that  the 
threshold  power  for  failure  is  inversely  proportional  to  the  square 
root  of  pulse  duration. 

It  is  convenient  to  think  of  the  threshold,  tf  of  an  individual 
component  in  logarithmic  terms, 

t  -  20  loq1()(It/Il)( 

wl.ore  It  is  the  threshold  current  and  Ic  is  a  reference  current. 
Thresholds  vary  between  copies  of  "the  same"  components.  Thresholds 
ace  actually  measured  experimentally,  by  destructive  step-stress  tests 
(Appendix  F) .  It  turns  out  that  the  distribution  of  logarithmic 
tntesholds  is  often  taken  to  be  "nearly  ncrmal/Caussian"  as  a 
Citsc-otder  approximation.  In  what  follows,  the  term  threshold  will 
mean  the  quantity  t,  as  above.  Work  by  Alexander  and  Enlow  (1981) 
seems  to  show  the  existence  of  some  semiconductor  "weak  sister3," 
evidenced  by  threshold  distribution  skewness  to  the  left  or, 
equivalently,  a  relatively  long  tail  towards  small  values,  for  so»e 
tests.  Once  recognized,  this  weakness  may  perhaps  be  curable,-  hence 
it  may  not  occur  in  the  future. 

In  statistical  terms,  think  of  the  threshold,  t,  of  a  given 
device  as  a  realization  of  a  random  variable  T,  with  distribution 
f*T (x) — the  probability  that  T  is  less  than  or  equal  to  r.. 

Ft(x)  is  possibly  normal,  or  nearly  so.  Think  of  different  copies 
of  the  same  device  as  having  thresholds  independently  selected  from  a 
population  of  devices  described  by  FT{x) — at  least  as  a  first 
approximation. 
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Characterization  of  all  variability  between  individual 
semiconductor  component  copies  as  independent  and  random  is 
conceptually  a in.pl  1st ic.  There  can  perhaps  be  different  variability 
characteristics  (different  distributions)  for  nominally  the  same 
component  oecause  of  oetween-batch  dissimilarities  in  manufacture  or 
shelf  life.  Thus  the  actual  components  in  place  on  the  test  aircraft 
may  not  be  a  random  sample  from  the  same  devices  found  on  shelves  or 
delivered  by  manufacturers. 

Note  that  the  above  discussion  emphasizes  the  natural  variability 
at  thresholds.  It  does  not  refer  to  errors  of  estimates  of  thresholds. 


This  appendix  uses  the  term  stress  to  mean  the  current  delivered  to  a 
box,  or  component  thereof,  by  EMP.  The  stress  applied  to  a  component 
comes  through  a  wire  within  a  cable  into  a  box  and  then  to  a  component. 

The  magnitude  of  stress,  again  logarithmically,  is  often 
represented  as 


s  -  20  log10(Is/Ir), 
where  Is  is  the  stress  current. 

0*.e  may,  in  some  cases,  think  of  s  as  being  an  instance  of  a  random 
variable,  S.  Such  may  be  especially  relevant  in  an  operational 
environment,  where  the  stress  experienced  by  the  aircraft  vac ies  with 
orientation,  altitude,  nuclear  burst  height,  and  other  parameters..  In 
the  context  of  an  experimental  assessment,  there  is  an  attempt  to 
condition  on  these  experimental  variables.  This  conditioning  removes 
one  source  of  stress-associated  variability. 

However,  assessment  is  conducted  under  less-than-operational  stress 
considerations,’  and  it  kb  necessary  to  "extrapolate  to  threat  criteria 
levels,"  using  a  model*  Two  methods  of  such  extrapolation  were 
apparently  used  for  the  EC-135  aircraft.  Such  methods  are  likely  to 
have  systematic  elements  (biases)  that  are  unknown.  Accordingly,  uee 
of  two  methods  is  a  sign  of  care.  Note  too  that,  given  the  external 
stress,  it  is  necessary  to  consider  variations  of  wire  currents 
attributed  to  point  of  entry.  Furthermore,  it  has  been  necessary  to 
estimate  or  predict  wire  current,  from  bulk  cable  currents.  The 
methods  foe  doing  so  are  acknowledged  to  have  certain  errors  that 
be  assessed  from  measurements  (Appendix  C) •  Notice  again  that  such  a 
prediction  is  susceptible  to  systematic,  bias-like  errors  as  well  as 
"random"  errors.  It  is  the  latter  that  are  handled  best  by 
probabilistic  and  statistical  tools.  Assessment  of  the  former  seems 
to  be  situation-specific. 

It  was  apparently  also  the  practice  to  equate  the  vulnerability  of 
a  box  with  that  of  the  device  closest  to  the  terminals  of  the  bo  c* 

That  ir,  one  assumed  that  all  but  one  crucial  microelectronic  device 
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have  no  vulnerability.  This  assumption  is  a  simplifying  one  that  is 
not  conservative,  because  remote  devices  could,  in  principle,  foil.  A 
more  sophisticated  approach  might  utilize  methods  such  as  fault  tree 
analysis,  but  it  is  likely  that  prediction  principles  for  box-level 
failure  are  not  well  understood.  Again  bias,  as  well  as  random 
errors,  may  well  be  present  in  box-level  assessment  of  failure. 

In  summary,  errors  in  thresholds  and  stress  may  well  be  both 
"systematic"  and  "random."  Thebe  errors  propagate  into  the  estimate 
of  safety  margin  (Appendix  F)  and  so  may  affect  ssessments  of 
hardness  and,  eventually,  confidence  statements  concerning  probability 
of  survival. 


GENERAL  COMMENTS  ON  THE  ASSESSMENT 

The  authors  of  the  EC-135  assessment  reports,  both  classified  and 
unclassified,  wisely  devote  considerable  attention  to  expressing  the 
uncertainties  inherent  in  their  margin  determinations.  Here  are  some 
comments  or.  what  ha3  been  done. 

Firstly,  the  language  used  to  express  these  uncertainties  is  not 
entirely  standard.  Unfortunately,  words  have  been  used  in  EC -135 
assessment  reports  that  have  somewhat  different  stardard  statistical 
meanings  ("confidence")  or  that  have  standard  meanings  outside  the 
area  of  statistical  practice  ("reliability")  and  yet  are  used  in  an 
error-characterization,  statistical  context  in  these  reports  and  in 
supporting  documents.  In  what  follows  an  attempt  will  be  made  to 
clarify  some  of  this  ambiguity. 

Secondly,  the  statistical  practices  used  to  quantify  and  combine 
"random"  errors  in  the  EC-135  assessment  reports  can  very  likely  be 
improved  and  made  somewhat  lees  subject  to  criticism.  Some  of  the 
information  needed  for  improvements  is  based  on  statistical  theory 
available  at  the  time  of  the  assessment;  other  information  is  not  so 
based,  or  possibly  it  is  not  completely  understood  today. 


Confidence 

The  notions  of  personal  confidence  and  confidence  limits  are  utilized 
several  times  in  the  EC-135  assessment  reports.  Unfortunately,  from 
the  point  of  view  of  principles,  the  term  confidence  is  applied  to  an 
overall  calculation  that  combines  two  distinct  concepts  of  confidence, 


Classical  Concept 

The  first  concept  is  the  classical  sampling- theory  confidence  ideas  of 
Neyaan;  see  Cramer  (194$) ,  Cox  and  Hinkley  (1974;  or  many  other 
standard  sources.  This  approach  assumes  that  an  unknown  parameter  or 


constant  of  interest  is  a  fixed,  unknown  constant.  Specifically,  the 
true  margin  of  an  EC-135,  or  a  system  or  box  therein,  has  a  specific 
unknown  value  at  assessment  time.  Likewise,  the  variance  of  the  total 
error  made  in  estimating  true  margin  is  a  fixed,  unknown  constant. 
Errors  in  the  parameter  estimates  are  instances  of  random  variables. 

When  classical  confidence  limits  are  formed,  for  example  after 
assessment  data  are  analyzed,  it  is  agreed  that  the  resulting  limits 
either  cover  (capture),  or  fail  to  cover,  the  unknown  parameter,  tlo 
probability  statement  is  made  about  the  particular  limits  resulting 
from  the  particular  assessment  data;  no  probabilistic  statements  are 
mcJe  about  the  value  of  the  parameter  of  interest.  Probabilistic 
statements  are,  instead,  made  concerning  coverage  properties  of 
confidence  limits  constructed  from  other  sets  of  data,  actually  or 
conceptually  obtained,  that  are  afflicted  with  the  same  error  sources. 

Classical  confidence  procedures  may  be  criticized,  but  they  are  a 
standard  expression  of  sampling  uncertainty. 

Probabilistic  Concept 

A  different  notion  of  confidence  has  been  defined  by  Ashley  and 
Locasso  (1977)  ard  used  in  the  EC-135  assessment.  This  form  differs 
from  the  above  concept  in  assigning  probabilities  to  the  possible 
values  of  an  unknown  parameter.  Quite  specifically,  the  Ashley 
confidence  assigns  a  probability  density  (at  some  point  called  a 
■confidence  density  function*)  to  the  unknown  probability  of  success 
in  a  sequence  of  Bernoulli  trials  (coin  flips  with  biased  coin) ;  the 
density  obtained  is  conditional  on  the  number  of  successes  observed  in 
a  fixed  number  of  trials.  In  the  Ashley  scheme,  the  confidence  that 
the  unknown  probability  of  success  exceeds,  say,  0.90  is  the  integral 
of  the  above  conditional  density  from  0.90  to  1. 

Examination  of  the  formula  obtained  for  the  above  density  reveals 
that  it  is  entirely  equivalent  to  a  simple  standard  Bayesian 
formulation:  if  a  uniform  prior  probability  density  is  associated 
with  unknown  values  of  p--the  probability  of  success — and  the 
observations  taken  and  a  binomial  likelihood  calculated,  the  result  is 
precisely  what  has  long  been  called  the  posterior  probability  density 
of  p.  The  uniform  prior  probability  density  is  justified  by  Ashley, 
using  words  like  ‘maximum  ignorance  assumption.*  That  this  approach 
is  not  acceptable  is  demonstrated  easily  by  consideration  of  the  fuel 
consumption  of  a  population  of  automobiles,  for  which  'maximum 
ignorance*  might  assume  a  uniform  distribution  in  miles  per  gallon  or, 
alternatively,  in  gallonB  per  mile.  If  one  is  flat,  the  other  is  not: 

Unfortunately,  the  above  notion  has  also  been  called  confidence, 
without  distinguishing  it  from  classical  confidence.  It  is  also 
claimed  that  ‘the  analysis  begins  with  intuitively  acceptable 
statements  about  confidence  and  proceeds  without  recourse  to  devices 
such  as  Bayes'  rule....*  In  fact,  the  concept  is  entirely  equivalent 
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to  a  simple  form  of  Bayes*  rule  (ar.  equivalence  that  is  not  pointed 
out).  One  difficulty  with  standard  Bayes  approaches  to  statistics  is 
specification  of  a  suitable  prior  distribution.  Assignment  of  a 
uniform  prior  probability  density  in  the  Bernoulli  trials  rituation 
must  somehow  be  justified.  Arguments  tor  such  a  prior  probability 
density  will  not  convince  everyone,  and  they  are  in  no  way  new. 

Perhaps  fortunately,  calculations  made  using  the  above  confidence 
result  in  numbers  that  are  not  very  different  from  classical  results 
of  the  type  first  described  above.  This  effect  is  widely  encountered 
in  Bayesian  analyses  when  so-called  vague  or  diffuse  prior 
distributions  are  used;  the  uniform  distribution  is  a  vague  prior. 

Bayesian  concepts  have  an  important  role  to  plav  in  statistical 
inference.  It  is  troubling  to  fxnd  a  simple  version  of  such  concepts 
repackaged  and  renamed.  Such  cannot  lead  to  good  communication  of 
analytical  results.  It  seems  to  represent  a  *tind  of  insularity  that 
inhibits  rapid  assimilation  and  application  of  promising  new,  not  to 
mention  appropriate  classical,  methods. 


Reliability 

The  term  reliability,  as  used  in  the  EC-135  assessment  reports,  is  not 
the  cc  .ventional  probability  of  successful  od  ‘ration  of  a  component  or 
system.  According  to  the  definition  given  ia  one  such  report  it  is 
the  following: 

The  term,  reliability,  is  used  in  this  report  to  mean  a  lower  bound 
on  the  probability  that  a  margin  is  at  least  some  specified  value. 
That  is.  it  is  the  reliability  of  a  statement  that  the  margin  is  at 
least  a  given  value.  Ibis  is  not  the  same  as  the  reliability  of  a 

component  cr  system  except  in  the  special  case  in  which  uhe  safe  in 

specified  happens  to  be  0  decibels  (dB) . 

—  Rockwell  International  Corporation  (1978) 

The  idea  is  to  quota  a  lower  level  for  margin  that  is  computable 
frem  data  and  that  has  a  quantifiable,  probabilistically  expressed 
nature.  The  limits  used  appear  similar  to  tlje  tolerance  limits  of 
statistics,  as  studied  by  Shewhart  (1939) ,  Wilks  (1941) ,  anu  Wald  ai*d 
Wolfowitz  (1946).  There  is  some  evidence  that  the  authors  of  the 
EC-135  report  realized,  and  made  use  of,  this  fact.  Such  lower  limits 

were  computed  for  each  of  the  28  (sub) systems  in  the  EC-135;  and  they 

were  used  to  rank  those  subsystems  for  hardness,  that  is,  the  degree 
to  which  margin  seemed  positive. 

In  a  strict,  classical,  non-Bayes  sense,  there  is  no  meaning  to  "a 
lower  bound  on. the  probability  that  a  margin  is  at  least  some 
specified  value,"  if  one  interprets  this  as  a  probability  on  the 
margin  itself.  "Probability"  here  refers  to  errors  in  the 
determination  of  the  margin,  the  latter  being  viewed  as  an  unknown 
constant. 


If,  as  seems  quite  possible,  achieved  margin  varies  from  system 
copy  to  copy  and  if  measured  margin  exceeds  some  level,  then  the 
conditional  probability  that  true  margin  itself  exceeds  a  meaningful 
level  can  be  calculated.  However,  it  is  necessary  to  have,  or 
estimate,  the  equivalent  of  the  distribution  of  actual  margins  and  the 
conditional  distribution  of  measured  margin  (or  error  in  determining 
margin) ,  given  actual  margin,  in  order  to  make  the  interesting  Bayes* 
rule  calculation.  It  has  not  appeared  that  such  a  calculation,  with 
its  necessary  but  expensive  ingredients,  has  been  attempted. 


RELIABILITY  AND  CONFIDENCE  IN  THE  EC-135  ASSESSMENT 

The  ideas  of  reliability  and  confidence  are  combined  and  applied  to 
EC- US  assessment  in  an  attempt  to  bound  (sub) system  margin  from 
celow.  This  step  was  deemed  prudent  because  errors  were  acknowledged 
co  occur  at  various  stages  of  the  assessment;  and  the  latter  were 
fake,,  to  be  random — that  is,  suitably  described  as  random  variable 
realizations  and  not  as  biases.  Units  were  always  decibels. 


Assessment  Bi  icedure 

Here  is  the  procedure  apparently  used  (Ashley  and  Loeasso,  1977,  plus 
later  explanation  apparently  furnished  by  Ashley),  along  with  cur 
comments.  Th'i  step  numbers  used  by  the  authors  have  been  retained  for 
e^se  of  reference. 

1.  Seven  ^7)  margin  error  sources  were  identified. 

2.  Consider  each  margin  error  source  i  (i  *  X,2,...,'*r  here  k  *»  7 
from  step  1) . 

a.  i*,  was  possible  to  obtain  records  o Z  observed  or  estimated 
errors.  (Note:  Details  for  this  step  ace  unclear.) 

b.  Margin  errors  (d3)  for  source  type  i  were  compared  to  the 
Gace&ian/normal  distribution:  apparently  meat,  and  variance 
werr  estimated  and  a  chi- squared  test  performed;  the 
Gaussian/normal  model  wos  accepted  as  true  if  the 
chi-Bquated  statistic  did  not  exceed  a  critical  value. 

(i).  If  thw  e**ror  source  data  "clearly  passed"  the  ubovo 
test,  then  the  data  were  treated  as  if  they  were 
precisely  Gauss iar./normal  in  the  following 
analytic.  (Note:  The  only  graphical  assessment  c * 
the  Gauss  ian/no.  model  was  by  histograr..  More 

sensitive  methods  (with  respect  to  to  tail 
Dohavicr)  would  be  plotting  on  aritncetic 
probability  paper  or  Q-Q  piots.) 
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Supposing  the  data  passed  tbt  goodness-of-f l t 
test,  the  ordinary  sample  standard  deviation 
(subscript  *0"  for  '"ordinaty")  , 


of  the  data  values  x13  f-  *  1,2,..  was 

corcptildd  for  the  lth  erro,  source.  This  quantity 
was  then  adjusted  upwards  so  as  to  give  sx#  a 
number  approximating  the  upper  *0%  point  of  the 
sampling  distribution  of  the  ordinary  sample 
standard  deviation,  where 


Here  Cx  represents  confidence  level  and 

X*4  .  (1-C  )  is  the  (i-C  >*100%  point  oi  the  cbi- 

n^-i  1  1 

squared  distribution  with  nx-l  degrees  of 
freedom.  (Note:  To  be  definite,  suppose  nx  * 

31  and  Cx  =  G.9r  tnen  tables  give  for  the 
’tultiplier  of  the  ordinary  sample  standard  the 
number  (1/0. 687) 1/2  *  1.21.  Even  if  the  normal 

approximation  for  the  estimates  of  n  ^  were  used, 

this  answer  is  very  nearly  the  same  for  this  sample 
site. > 

If  Uto  aoodness-of-f it  test  was  not  passed,  ^ 
fc-ased  on  a  Baves-lite  calculation  wan  utilized. 
(Bote.  This  step  is  not  easily  understood, 
especially  when  seer,  in  the  context  of  the  previous 
steps,  whicn  saw-  a  classical  statist- ica- 

fljr^or .  n  our  sumseouen^  consents  on  this 
£tS3escment  procedure,  we  gnore  step  -i)  w 

•Compute  V>  *  s". 


•c — • 
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4.  Compute  s  *  0  . 

C  A*aume  k  large  bn»nigh  to  juflt  .y  assertion  that  the  sum  of 

2  2 

errors  in  bounding  the  true  pob«t*tion  variances  ff  ^  by  is 

ap*  coximatwip  hOCC&ai.  (Note*  Passage  of  tests  for  normal 
optimistically  suggests  adequacy  of  the  normal  assumption, 
^ossibly  uniass  the  need  T(u  step  (ii)  is  encountered  and 
unless  there  •«l»te  en  unfortunate  dependence  between  errors. 

It* 's  tetter  possibility  does  not  seem  to  have  been  addressed.) 

*  Accept  s*0  1/2  as  upper  bound  on  standard  deviation  CT  for 
-txie  total  error  distribution.  ^ 

Compute  a  lower  bound  on  the  maty  in  =  mg. 5  "  where 

-  ia  the  measured  value  of  margin  and  z  is  taken  from  the 
normal  probability  tables.  Por  example,  for  one-sided  95%,  z  « 
1.645  for  one-sided  90%,  z  *  1.28,  and  so  forth. 

Assign  to  ,iie  confidence  min(C^);  it  is  understood  that 
if  3j  is  computed  at  iKildl’td,  with  C£  *  0.9,  and  if  the 
possibility  (ii)  ip  neglected  or  does  not  occur,  then  a 
confidence  of  90%  in  the  overall  statement  will  be  achieved. 

9.  Allowances  must  oe  made  for  mission-specific  subsystem 
requirements  when  carrying  out  confidence  calculations. 


Comments 

Th^  procedure  outl  ned  aoove  Involves  many  steps.  The  final  assertion 
is  one  ~f  overall  sonfirienca  in  an  error  bound.  It  will  be  pointed 
out  that  at  _»**£  ont  of  rnt  steps  taken  leads  to  literally  incorrect 
results.  It  —  not  known  *e*t  the  actual  overall  "confidence" 
associated  *  tt  me  procedure  is.  This  question  could,  however,  be 
investigated  09  the  fcuucc  tarlo  method  under  plausible  assumptions. 
Such  a  step  always  advt-iaii ie. 


Analysis,  ot  the  i^tifcation  Procedme 

Ite.e  ib  a  sij=rclr*i*«;  :i5cr-aion  of  the  procedure  outlined  above  and, 
pr»'susar-2 r  rc  _  KC*135  assessment. 

Suppose  there  cce  s  ^rcor  sources,  and  assume  errors  are  inde¬ 
pendent)  y  an«l  normal ’.r  ±istr  ibnt^d  with  variance  of  the 

source  being  “  The  object  is  to  put  a  confidence  limit  above 

- 

,T  *  V-  T  V  witt  presentee  confidence  level  GMQOt . 

1 


_  _  4? 


81 


I 

I 


i 


i 


The  procedure  described  by  Ashley  and  Locasso  can  be  seen  to  oe 
1 7 ter  ally  incorrect  from  the  following  special  example.  Take 
2  2 

(T ^  that  is,  all  variances  equal;  and  also  let  n^  =  n^  so  all 

sample  sizes  are  equal.  Under  this  assumption  the  factor  M  raulti- 

2 

plying  tne  ordinary  sample  variance  s^q  in  order  to  generate  an  upper 


•-i- 100%  confidence  sound  on  (J  2  *  O  ^  is  always  (n  -1)/X  ^  _  ( 1—  Of )  *  M. 

l  1  1  n^-1 

Since  the  independent  (ni  -1)  s^/ O  \  are  distributed  as  chi-squared, 

and  since  the  sum  of  independent  chi-squared  distributions  is  also 
distributed  an  chi-oguared,  with  degrees  of  freedom  equal  to  the  sum 
of  the  separate  degrees  of  freedom,  under  the  circumstances  mentioned 
we  have 


<n,-l)k<jr  -  ,* 
i  d  o2 


sIj/  °2  ~  xV_1)k. 


where  —  means  “is  distributed  as" — here  as  cm-squared  with 

2  2 

(n^-ljk  degrees  of  freedom.  Note  that  O  3 
in  this  particular  case.  Consequently, 


*  in,-mlX_a;> 


with  exact  confidence  C£  for  one  set  of  data  (or  with  proDability  OC 
over  many  independent  experiments).  However,  it  is  proposed  by  Ashley 
and  Locasso  to  quote 


M(s 


2 

ol 


J  > 


a 


2 


2 

with  confidence  C¥;  here  M  *  (n  ,-\)/X  .(1-Gf'  as  above.  This  mul- 

1  n  -1 

2  2 

tiple  of  (so^  ♦  ...  +  sQk)  does  not  give  a  confidence  of  CK-100%,  but 

something  much  nigher.  If,  for  instance,  n^  =  21  and  (X  =  0.3, 

2  2 

then  M  *  1.61.  However,  for  this  multiple  of  (sqi  +  ...  -*•  sQk)  ,  and 

for  r  *  21  and  k  *  7,  a  quick  examination  of  chi -squared  tables  shows 
that  confidence  Is  at  least  at  the  99.5%  level.  In  this  instance,  the 

proper  multiple  of  (s2.  +  ...  ♦  s'  )  to  ati.  m  90%  confidence  is  1.18. 


i 


Although  such  conservatism  seems  laudable,  it  is  not  clear  that  xts 
presence  was  recognized. 


Other  Approaches  to  the  Variance  Estimation 

Of  course  similar  calculations  cannot  in  general  be  made  exactly,  but 
a  number  of  approaches  do  exist  for  getting  reasonable  approximate 
confidence  limits  on  a2.  These  include  the  following. 


1.  Large-sample  normal  approximation  for  standard  error  and 

a  2  a  2  a  2 

approximate  confidence  limits  Assume  that  o  *(?,  +  ...  +  a  .  is 

2  x  K 

approximately  normal  with  mean  0  and 


var[52i  »  £  —7  =  £  r-f. 

i=i  ni  1  i-i  ni  1 


.  A  2 
where  a  ^ 


£  (x  -  x  )2/(n.-l).  The  approximate  variance  of  <j  2 
3-1  3 


is  easy  to  compute,  assumes  the  underlying  observations  are  exactly 
normal,  and  should  be  useful  at  least  for  rough  assessments, 
especially  if  np  values  are  rather  large  (perhaps  25  or  more) ; 
unfortunately  they  often  are  not  so  large.  This  procedure  is, 
however,  notoriously  sensitive  to  the  assumption  that  the  underlying 
data  are  normally  distributed;  this  difficulty  already  arises  for  the 

individual  ff  2 .  It  is  true  that  the  cube  root  of  the  sample  variance 

when  ooservatlons  are  normal,  is  close  to  the  normal  form.  Use  of 
this  fact  may  improve  the  above  approximation  (details  omitted.). 


2 

2.  An  approximation  of  the  distribution  of  ff  by  a  moment-fitted 
gamma  (chl-squated)  distribution  This  procedure  was  first  proposed 
by  H.  Fairfield  Faith,  who  thanked  "Dr.  R.  A.  Fisher"  for  the 
suggestion.  Often  associated  with  Satterthwaite  (1946),  the  method 
has  been  used  by  many  through  the  years  for  approximating  nearly-chi- 
squared  distributions,  of  which  the  above  is  an  example.  It  has,  for 
instance,  been  used  in  the  Welch  two-sample  t-distribution  approxi¬ 
mation;  see  Brownlee  (1965),  pp.  300-301.  For  the  present  problems. 


use  of  these  results  seems  appropriate:  2J  i®  approximated  by  a  X 

1-1 

k 

variable  with  mean  (j  .  and  degrees  of  freedom 
1-1 


‘(s  ‘‘)2/  (s 


Tn  other  words  act  as  if 


from  which  approximate  confidence  limits  are  obtained.  Preliminary 
Monte  Carlo  sampling  studies  suggest  that  this  method  works  well 
provided  the  data  are  nearly  normal  and  the  true  variances  do  not 
differ  by  factors  of  more  than  ten.  Severe  nonnormality  of  the 
underlying  data  may  well  call  for  modifications  in  this  method. 


2  a  2 

.  An  approximate  distribution  for  a  ,  given  a  ,  using  a 


large-deviation  technique  The  result  would  be  Bayesian  confidence 
limits.  This  technique  needs  development  before  it  can  be  adequately 
evaluated;  it  is  not  yet  standard. 


4.  The  jacknife  Here  it  is  probably  best  to  put  confidence  limits  on 
2  2  1/3 

In  O  or  ( O  )  by  jacknifing  either 

A?  A2^2  A  2 

In  a  *  «  ln<(J*  +  <7  2  +  ...  +  O  *) 

,A2  1/3 
or  ( 0  ) 

See  Mosteller  and  Tukey  (1977)  for  details.  Properties  of  the 
jacknife  for  setting  approximate  standard  errors  and  confidence  limits 
are  supposed  to  be  rather  insensitive  to  non-normality;  the  quality  of 
the  results  can  be  investigated  by  Monte  Carlo  sampling.  The  jacknife 
is  perhaps  twice  as  computer -intensive  as  approaches  1  and  2,  above. 

Note  also  that  application  of  the  linearization,  or  "delta,*  method 
to  In  a  2  J.s  likely  to  be  better  oehaved  than  estimate  1,  above.  At 
least,  transformation  of  the  logarithm  back  to  O  2  certainly  assures 
that  confidence  limits  are  positive ! 
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5.  The  bootstrap  Here  one  proceeds  as  follows  from  data  x^j •  i  * 

1,2, j  »  l,2,...,n^.  For  each  i  separately,  draw  at  random 
with  replacement  from  original  raw  data  values  to  obtain  a  boot- 

i..  Then  compute  &  ?(b)  and  evaluate 


strap  sample  x, . (b) ,  j  *  1,2, 


CT2(b) 


k 

z 

i»l 


A2,,_, 

CTt(b) . 


Now  repeat;  sampling  with  replacement  from  each  group  i  »  V,2,...,k. 
Obtain  thus,  say,  200  values  of  <j2(b).  Order  the  resulting  values 
or  o2(b);  the  90%  value,  that  is,  20  down  from  the  largest, 
approximates  the  upper  90%  confidence  limit  for  a  2.  This  method  is 
believed  to  be  quite  insensitive  to  underlying  distributions.  It  may 
well  eliminate  worries  represented  by  the  introduction  of  atep  (ii). 
However,  more  work  could  be  done  on  its  performance  in  the  present 
context,  both  by  sampling  and  by  analysis.  Although  the  bootstrap 
seems  appropriate  here,  it  is  much  more  computer-intensive  than  the 
jacknife;  and  its  clear  advantage  for  the  present  application  has  not 
yet  been  established.  See  Efron  (1981)  and  Mallows  and  Tukey  (1983) 
for  details  and  commentary . 


Analysis  of  Margin  Uncertainty 

This  discussion  is  with  reference  to  step  7  above.  The  margin  quoted 
in  the  EC-135  study  is  actually  an  estimated  conservative  margin,  or 
reliable  margin.  Let  estimated  margin  be 

A  A  _  A  A 

i  ■  «.  -  ;s  >  >.  -so. 

HR  0.5  0.5 

A 

It  appears  that  if  <J  ■  s  is  afflicted  by  errors  from  various  sources, 
that  is,  is  estimated  with  uncertainty,  then  so  is  ®o.5* 

Consequently  it  should  be  of  interest  to  assess  the  uncertainty  in 
Sr.  It  has  not  been  possible  to  determine  just  how  errors  affect 
ra0.5,  but  perhaps  it  is  reasonable  that  a  quoted  estimate  is 
unbiased  and  that 


0.5 


B0.5  *  xl  +  *2  + 


true 


error  averages 


where  the  error  averages  from  the  k  »  7  sources  (here)  have  zero  mean 
(an  optimistic  assumption  signifying  no  bias),  and  are  independently 
sampled  from  their  respective  near-normal  distributions  with 
2 

variances  a  j.  Stipulating  this,  then,  suggests  that  confidence 


limits  on  =  s>0.5  “  zCf  itseit  should  be  of  interest*  This 
possibility  has  not  been  mentioned  in  the  EC-135  reports,  it  appears. 

Approximate  confidence  limits  for  the  above  margin  can  be  con¬ 
structed  in  various  ways.  For  example,  in  the  delta  (or 
linearization)  method,  compute 


Var  lmR] 
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i=l 


l®0,5!  +  2 2  VarI<b 
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A  4 

a  l  z2 
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_ _  v* 
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r. .  ?  A  2  A  2\ 

1/2  f* 

n.-i* 

1  K  +  -  +  >7J 

i*l 

l 

See  Cramer  (1946),  pp.  353-356  for  details.  Also  applicable  are 
jacknifing  (Chapter  3  of  Mosteller  and  Tukey,  1977;  Efron,  1981; 
Mallows  and  Tukey,  1983)  and  bootstrapping  (Efron,  19C'*;  Mallows  and 
Tukey,  1983). 
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APPENDIX  P 


ESTIMATING  PROBABILITY  OF  SURVIVAL  OF  A  COMPONENT 
BASED  ON  STRESS- STRENGTH  MODELS 


k 


r 
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THRESHOLD  LEVEL  AND  THREAT  LEVEL 

Failure  threshold  Hill  be  defined  herein  as  the  stress  level  at  or 
above  which  a  component,  device,  subsystem,  or  facility  will  fail  to 
perform  its  intended  function.  It  can  be  expressed  in  volts,  amperes, 
watts,  or  decibels  relative  to  some  reference  stress  level.  In  the 
decibel  domain,  the  random  variable  threshold  will  be  denoted  herein 
by  T. 

The  threat  level  is  the  level  to  which  the  item  (device,  subsystem, 
or  facility)  may  be  exposed  to  stress,  expressed  in  the  same  units  as 
failure  threshold.  In  the  decibel  domain,  the  random  variable 
electromagnetic  pulse  (EKP)  stress  is  denoted  by  S. 

The  random  quantities  T  and  S  can  be  defined  at  any  point  in  a 
system.  For  an  entire  system  chosen  at  random  from  nominally  similar 
systems,  T  is  the  stress  level  that  cannot  be  exceeded  for  survival  of 
the  system  (that  is,  specified  performance  of  its  designated  mission); 
and  S  is  the  level  of  EMP  threatening  the  system.  At  component  level, 
T  describes  the  stress  level  at  which  a  random  component  is  destroyed 
or  fails  to  function  in  the  required  manner;  and  S  describes  the  EMP 
stress  that  may  be  seen  at  the  input  terminal  of  the  component. 

The  value  of  T  depends  on  the  failure  mechanism,  since  one  failure 
threshold  level  might  mean  temporary  degradation  of  the  operation  of 
the  system,  another  level  might  mean  permanent  but  not  complete 
degradation,  and  another  level  might  mean  the  system's  total 
destruction.  We  assume  here  that  the  type  of  dysfunction  has  been 
specified. 


SAFETY  MARGIN 

The  random  variable  "safety  margin"  for  a  random  item  is  defined  as 
M  •  k(T  -  S),  where  k  is  some  known  positive  constant.  The  value  of  M 
is,  of  course,  also  given  in  decibels. 

If  safety  margin  for  a  particular  component,  system,  or  other  unit 
is  positive,  then  the  item  will  be  unimpaired  by  the  threatening  EMP 
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if  and  when  the  threat  is  realized.  On  the  other  hand,  if  the  safety  • 

margin  is  negative,  the  item  will  be  impacted  (for  example,  upset  or 
damaged)  upon  realization  of  the  threatening  stress. 


STATISTICAL  ASSESSMENT 

Typically  in  practice,  tests  to  estimate  failure  threshold  level  for  a 
random  item  in  a  population  are  made  by  exposing  to  stress  a  size-n 
random  sample  of  components,  devices,  or  systems.  See  the  sections  on 
accelerated  tests  in  Mann  and  Singpurwalla  (1983)  for  a  discussion  of 
typical  procedures  for  performing  such  stress  tests.  The  exposure 
might  be  to  several  fixed  levels  of  stress,  with  the  experimenter 
observing  the  proportions  that  fail  at  each  level.  Alternatively,  one 
might  increase  the  stress  by  some  organized  procedure  until  a 
specified  number  of  the  sample  fails,  or  until  a  prescribed  stress 
level  is  reached,  noting  in  each  case  the  decibel  level  that 
precipitates  failure. 

The  latter  testing  model  can  yield  a  sample  of  values, 
t^,...,tc,  r  less  than  or  equal  to  n,  of  the  random  variable,  T, 
if  the  stress  is  increased  continuously.  In  all  cases,  results  can  be 
expressed  in  the  form  of  a  histogram,  with  threshold  levels 
categorized  and  the  frequency  of  failure  indicated  for  each  category. 

From  each  value  t  of  the  random  variable  T,  we  can  subtract  a  value 
s  of  S  corresponding  to  an  appropriate  level  of  stress  for  the  EMP 
threat  to  the  item.  We  thereby  obtain  an  observed  value  m  of  the 
random  variable  M,  which  represents  the  safety  margin  for  a  random 
item  in  the  population  of  items.  We  may  want  to  know  the  probability 
P  that  M  Is  greater  than  0  in  the  population,  that  is,  p  »  p)m>o}. 

We  may  want  a  point  estimate  of  the  quantity  p;  but  more  likely  we 
will  wish  to  attach  some  statistical  level  of  confidence  and  say,  for 
example,  that  at  the  95  percent  confidence  level,  p  is  greater  than  p’ 
■  0.992;  that  is,  the  probability  of  a  random  item  in  the  population 
not  failing  is  greater  than  0.992.  The  value  0.992  would,  of  course, 
be  an  evaluation  based  on  the  data. 

To  obtain  a  value  of  p’  corresponding  to  some  given  confidence 
level,  we  need  data  and  a  model — or  a  device  for  coping  with  the  lack 
of  a  model.  Herein  lies  the  source  of  the  problem.  First,  there  is 
little  agreement  concerning  an  appropriate  distribution  for  threshold 
level,  that  is,  the  random  variable,  T,  although  some  study  has  been 
done  in  this  area.  See,  for  example,  Alexander,  Karaskiewicz,  and 
Enlow  (1981)  and  Jones  (Appendix  8,  presentation  on  May  21,  1983). 

Some  agree  that  T,  as  measured  in  decibels,  has  a  normal  (Gaussian) 
distribution;  but  Alexander,  Karaskiewicz,  and  Enlow  (1981)  found 
conflicting  results.  Graphical  plotting  of  the  data  on  various 
probability  papers  might  shed  further  light  on  this  issue. 
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Boeing  Company  (1981)  makes  a  case  for  using  a  particular  Beta 
distribution  to  describe  the  variation  m  stress  of  the  BMP  threat, 
but  there  has  been  no  real  empirical  verification  of  such  an 
assumption.  Paul  Ryl  (Appendix  B,  presentation  on  June  1-2,  1983) 
discusses  inherent  difficulties  in  doing  this,  including  possibly 
unjustified  linearity  assumptions  and  general  difficulties  simulating 
rise  times,  peak  power,  total  energy,  and  so  forth. 

Clement  and  Johnson  (1981)  seem  to  assume  that  both  T  and  S  are 
normally  distributed  in  the  decibel  domain  and,  consequently,  that  H, 
being  a  linear  combination  of  Gaussian  variates,  is  normal  as  well. 
Clement  and  Johnson  use  a  first-order  Taylor-series  expansion  (the 
•delta  method")  for  expressing  M  when  it  is  other  than  a  linear 
function. 

In  the  presentation  by  Ryl  mentioned  earlier,  he  suggests,  in  the 
light  of  difficulties  in  finding  parametric  models  for  the 
distribution  of  H,  that  one  assume  only  that  the  values  of  safety 
margin  for  every  item  in  a  sample  are  independent  and  identically 
distributed  and  therefore  that  the  number  X  of  occurrences  of  H 
greater  than  0  is  a  binonially  distributed  variate.  Por  this  reason 
he  suggests  using  the  binomial  model  for  determining  a  lower 
confidence  bound  on  p  corresponding  to  a  particular  level  of 
confidence.  Procedures  for  doing  this  make  use  of  the  Incomplete  Beta 
function  and  are  described  in  many  places,  for  example,  pp.  372-375  in 
Mann,  Schafer,  and  Singpurwalla  (1974).  Ryl  mentions  informally  the 
use  of  a  "Bayesian  binomial*  with  an  assumption  of  a  uniform  prior 
probability  distribution  for  p. 

In  response  to  the  suggestion  of  a  uniform  prior  distribution  for 
p,  one  might  consider  results  tabulated  on  page  499  in  Hann,  Schafer, 
and  Singpurwalla  (1974).  These  results  indicate  that  when  inference 
is  at  the  component  level  only  (rather  than  inference  to  systems  on 
the  basis  of  component  data) ,  using  a  uniform  prior  for  p  is 
considerably  less  conservative  than  using  the  traditional  assumption 
of  -In  p  uniform  on  the  positive  half  real  line.  The  latter 
assumption  produces  optimal  nonrandomized  confidence  bounds  for  p,  in 
that  they  give  the  shortest  confidence  intervals  with  corresponding 
assigned  confidence  level.  If  a  binomial  model  is  used  with  component 
data  in  combining  components  to  predict  the  value  of  p  for  a  system, 
then  Section  10.4  of  Mann,  Schafer,  and  Singpurwalla  (1974)  should  be 
consulted. 

An  assumption  that  might  possibly  not  be  satisfied  for  the  binomial 
model  is  that  the  process  is  in  control  and  that  p  is  the  same  for 
each  sample  generated.  (See  Mood,  1943.)  If  the  outcomes  depend  upon 
more  than  a  single  mechanism,  it  is  possible  that  the  distribution  of 
X  (the  number  of  occurrences  of  M  greater  than  0)  may  be  a  mixture  of 
binomials.  Whether  or  not  this  is  so,  one  should  be  aware  that  a 
binomial  model  that  lacks  prior  information  requires  extremely  large 
sample  sizes  to  predict  large  values  of  p.  If  p  is  very  much  larger 
than  1  -  1/n,  with  n  equal  to  sample  size,  estimates  of  p  will  tend  to 


be  equal  to  one  and  hence  of  little  use  in  extrapolating  to  systems. 
What  could  be  helpful  here  Is  a  starting  place  so  as  to  be  able  to 
begin  to  build  appropriate  models  by  using  the  best  data  available  so 
that  one  can  make  inferences  about  the  lower  tail  of  the  distribution 
of  M  and  hence  predict  p  effectively. 


A  POSSIBLE  METHOD  OF  ATTACKING  PREDICTION  OF  p 

A  first  step  in  solving  the  problem  of  efficient  prediction  of  p  is  to 
find  the  largest  good  quality  data  sets  available  for  the  problem  of 
interest.  Needed  are  samples  of  values  of  threshold  T  obtained  from 
stress  testing  random  samples  of  specified  items  of  concern. 
Non-categorical  data  or  data  corresponding  to  many  categories  are  much 
preferred. 

Along  with  these  samples,  one  needs  random  samples  of  values  of  the 
random  variable,  S,  roughly  approximating  the  sizes  of  the  samples  of 
failure  thresholds.  The  closer  these  are  to  values  that  EMP  pulses 
are  expected  to  induce,  the  better.  One  might  then  use  a  technique 
specifically  designed  for  non-parametric  density  estimation.  See 
Tarter  and  Marshall,  (1978).  This  technique  relies  on  the  relatively 
simple  mean  and  variance-covariance  structure  and  asymptotic  normality 
of  the  sample  trigonometric  moments.  However,  the  technique  has  not 
yet  been  tried  in  the  EMP  context. 
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APPENDIX  G 

TUTORIAL  ON  FAULT  TREE  ANALYSIS 


Some  of  the  presentations  (Appendix  B,  by  Newman  on  April  1-2,  1963, 
and  by  Mensing  on  August  9-10,  1983)  to  the  committee  alluded  to  the 
possibility  of  using  fault  tree  analysis  (FTA)  for  electromagnetic 
pulse  (EMP)  assessment.  None  of  the  presentations  discussed  a 
specific  application  of  FTA  in  the  context  of  interest.  Thus,  it  was 
thought  that  a  tutorial  appendix  on  FTA  emphasizing  the  key  ideas, 
notions,  terminology,  uses,  and  difficulties  would  be  of  benefit  to 
the  EMP  assessment  community.  The  references  cited  here  should  be 
consulted  for  a  more  detailed  understanding  of  FTA.  A  key  reference 
is  Barlow  (1983),  which  contains  the  latest  material  on  the  subject. 


FAULT  TREES 

Fault  tree  analysis  was  conceived  by  H.  R.  Watson,  of  Bell  Telephone 
Laboratories,  in  the  early  1960s,  for  the  safety  evaluation  of  complex 
systems.  The  technique  was  further  developed  by  D.  F.  Haasl,  of 
Boeing  Company.  It  is  currently  being  widely  used  in  engineering 
safety  analysis,  failure  modes  and  effects  analysis,  societal  risk 
analysis,  analyses  of  the  risks  of  transporting  hazardous  material, 
and,  most  importantly,  the  assessment  of  the  risk  of  nuclear 
accidents.  This  application  is  described  by  the  U.S.  Nuclear 
Regulatory  Commission  (1975)  in  its  well  known  WASH-1400  study, 
commonly  referred*  to  as  the  "Rasmussen  report."  It  is  fair  to  say 
that  by  now  the  technique  has  generated  a  substantial  clientele. 

Mathematically,  a  fault  tree  can  be  viewed  as  a  set  of  nodes,  N, 
and  a  set  of  arcs.  A,  with  direction.  Any  pair  of  nodes  may  be  joined 
by  at  most  a  single  arc,  which  may  be  a  "regular  arc"  or  a 
"complementing  arc,"  and  which  exits  one  of  the  nodes  and  enters  the 
other.  Any  node  can  be  characterized  as  a  basic  node,  which  has  no 
entering  arcs,  or  as  a  gate  node,  which  has  both  entering  and  leaving 
arcs,  or  as  a  top  node.  A  fault  tree  has  a  single  top  node.  The  top 
node  corresponds  to  a  serious  event,  such  as  system  failure,  nuclear 
accident,  or  system  not  EMP-hardened.  Typically,  there  are  few  if 
any,  data  available  for  the  top  node  (event) .  A  basic  node  is  one  for 
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which  there  is  no  intention  of  further  analysis.  A  basic  node  would 
correspond,  for  example,  to  the  failure  of  a  small  component  or  a 
sub-system  not  EMP-hardenedj  typically,  one  has  many  data  and  much 
experience  for  a  basic  node  (event).  Gate  nodes  correspond  to 
intermediate  events,  for  which  there  may  or  may  not  be  many  available 
data.  Figure  1  illustrates  a  fault  tree  with  basic  nodes  labeled  from 
9  to  14,  the  top  node  labeled  1,  and  the  gate  nodes  labeled  from  2  to 
8. 

A  tree  is  constructed  top  down  deductively  by  engineers  and  system 
analysts  who  have  an  intimate  knowledge  of  the  system.  However,  the 
analysis  and  the  flow  of  logic  is  jpwards,  from  the  basic  nodes  to  the 
top  node.  Thus  the  arcs  in  Figure  1  have  arrows  that  point  upwards. 

Associated  with  each  gate  is  a  logic  symbol.  The  or  gate  denoted 
by  the  symbol  implies  set  union,  and  the  and  gate  denoted  by  the 
symbol  za  implies  set  intersection.  Thus  for  example,  the  gate  event 
labeled  3  occurs  If  and  only  if  either  the  gate  event  4  or  the  gate 
event  5,  or  both,  occur.  The  gate  event  5  occurs  if  and  only  if  both 
the  gate  events  7  and  8  occur.  The  arc  connecting  the  gate  events  4 
and  6  is  a  complemented  arc  denoted  by  " — this  terminology  means 
that  the  gate  event  4  will  occur  if  and  only  if  the  basic  event  11 
occurs  and  the  gate  event  6  does  not  occur. 

Fault  trees  of  large  and  complex  systems  involve  a  logic  that  may 
be  more  elaborate  than  the  set-union  and  the  set-intersection  logic 
mentioned  above.  To  account  for  these  situations,  other  types  of 
gates  are  used — the  more  typical  ones  being  the  exclusive  or  gate  and 
the  priority  and  gate,  denoted  by  other  symbols.  In  the  former,  the 
output  event  occurs  if  exactly  one  of  the  inputs  occurs,  whereas  with 
the  latter,  the  output  event  occurs  if  all  the  inputs  occur  in  a 
specified  order.  Another  gate  commonly  employed  is  the  k  out  of  n 
logic  gate,  denoted  by  "k/n.M  Here,  the  output  event  occurs  if  at 
least  k  of  the  n  input  events  occur. 

Figure  2  illustrates  the  role  of  the  gate  logic  in  constructing  a 
fault  tree.  The  event  of  interest  here  is  the  failure  of  component  A, 
which  is  required  to  perform  some  function  for  a  duration  of  T 
hours.  As  is  illustrated,  component  A  is  said  to  nave  failed  if  it 
either  fails  to  start  on  demand  or  if  it  starts  on  demand  and  it  fails 
to  function  for  the  desired  T  hours.  The  or  gate  under  the  top  event 
is  the  appropriate  one  here.  The  role  of  the  intermediate  and  gate 
should  be  clear  from  the  context  considered.  A  good  source  for  more 
detailed  information  on  the  construction  of  fault  trees  is  the  U.S. 
Nuclear  Fegulatory  Commission's  Fault  Tree  Handbook  (Vesely  et  al., 
1981) . 


SOURCE:  After  Barlow  (1983) 

FIGURE  1  An  illustration  of  a  fault  tree. 
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SOURCE:  After  Vesely  et  al.  (1981) 

FIGURE  2  Role  of  the  gate  logic  in  constructing  a  fault  tree. 


WHY  ARE  FAULT  TREES  USEFUL? 


From  the  above  discussion,  it  should  be  obvious  that  the  fault  tree  is 
a  useful  tool  for  the  analysis  of  a  system  design.  Specifically,  the 
fault  tree  functions  as  follows: 

1.  It  serves  as  an  aid  in  determining  the  possible  causes  for  the 
occurence  (or  not)  of  the  top  event. 

2.  It  may  lead  one  to  the  discovery  of  event  combinations  that 
otherwise  might  not  have  been  recognized. 

3.  It  enables  one  to  compare  and  contrast  various  designs  or,  for 
example,  different  strategies  for  the  EMP  hardening  of  a  large 
system. 

4.  It  enables  one  to  pinpoint  critical  event  scenarios  via 
calculation  of  what  are  known  as  the  importance  measures. 
Importance  measures  would  be  Important  within  the  context  of 
EMP  hardening  if  one  were  to  selectively  harden  a  system.  It 
would  pinpoint  those  components  and  subsystems  on  which  one 
should  concentrate  hardening  efforts,  given  that  shielding  the 
whole  system  was  untenable  or  prohibitively  expensive. 

5.  Finally,  and  most  importantly,  a  f'ult  tree  enables  one  to 
compute  a  numerical  impression  of  the  probability  of  occurrence 
of  the  top  event  when  few  or  no  data  on  its  occurrence  are 
available.  In  the  context  of  EMP  assessment,  the  calculation 
of  the  probability  of  the  top  event  enables  one  to  compare  two 
competing  hardening  tonemes. 


THE  MATHEMATICAL  ANALYSIS  OF  A  FAULT  TREE 

The  analysis  of  a  fault  tree  is  based  on  Boolean  switching  theory  and, 
as  such,  uses  binary  variables  taking  on  values  0  and  1.  A  good 
reference  for  the  mathematics  of  fault  trees  is  Barlow  et  ai.  (1975). 

Central  to  the  analyses  of  a  fault  tree  is  the  notion  of  min  cut 
sets.  If  the  top  event  of  a  tree  (without  complementing  arcs) 
represents  failure,  then  a  min  cut  set  is  the  smallest  combination  or 
component  failures  that,  if  they  all  occur,  will  cause  the  top  event 
to  occur.  (If  any  one  of  the  failures  in  a  cut  set  does  not  occur, 
the  top  event  will  not  occur.)  Any  fault  tree  will  consist  of  a 
finite  number  of  min  cut  sets  that  are  unique  for  the  top  event.  For 
the  fault  tree  of  Figure  1,  the  min  cut  sets  are  (S,  IS),  (12,  14), 
(13),  and  (11). 


A  Difficulty  with  the  Practical  Implementation  of 
Fault  Tree  Analysis 


It  has  been  shown  that  the  problem  of  finding  the  complete  min  cut  set 
family  of  a  fault  tree  is  a  member  of  the  class  of  so-called 
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NP-complete  problems ,  a  subset  of  the  class  of  nondeterministic, 
polynomial-time  (NP)  problems*  That  is,  we  cannot  expect  to  devise  an 
algorithm  whose  running  time  is  bounded  for  all  fault  trees  by  a 
polynomial  in  the  number  of  nodes*  For  example,  a  tree  with  more  than 
100  gate  nodes  with  an  appreciable  number  of  or  gates  may  have 
millions  of  sets  in  the  min  cut  set  family.  Thus,  in  practice,  it  is 
possible  that  a  particular  fault  tree  may  pose  some  practical  problems 
with  the  implementation  of  its  analysis,  because  of  one's  inability  to 
enumerate  all  its  min  cut  sets. 


Algorithms  for  Finding  the  Min  Cut  Sets 

Several  algorithms  and  computer  codes  for  determining  the  min  cut  sets 
of  fault  trees  have  been  devised,  most  of  them  under  the  aegis  of  the 
U.S.  Nuclear  Regulatory  Commission.  A  simple  and  powerful  algorithm, 
suitable  for  trees  without  complemented  arcs,  is  due  to  Fussell  and 
Vesely  (1982).  An  algorithm  for  trees  with  complemented  arcs  is  due 
to  Worrell  (1975).  Various  computer  codes,  and  their  characteristics, 
for  generating  the  min  cut  arc  sets  of  a  fault  tree  are  described  in 
the  literature.  Potential  users  of  FTA  for  EMP  assessment  work  may 
find  this  information  useful. 


Calculating  the  Probability  of  Occurence  of  Any  Node  Fault 


Once  a  fault  tree  has  been  drawn  and  its  rain  cut  sets  enumerated,  the 
next  step  is  the  calculation  of  the  probabilities  of  occurence  of  the 
various  gate  nodes  and  the  top  node.  The  general  principle  used  here 
is  that  of  inclus ion-exclus ion .  Thus  for  example,  the  fault  tree  of 
Figure  1,  which  has  as  its  min  cut  sets  ■  (9,  10),  S2  * 

(12,  14),  S3  *  (13)  and  S4  *  (11),  will  give  the  probability  of 
the  top  node  occurence  as 

pjtop  node  occurs)  *  P  j  S 

I  i-1  1 


*  E 

1<  3  <  k 


-  pjs1ns2ns3ns4j,  <» 


where  *1 J"  denotes  the  event  that  one  or  more  constituent  event  occurs 
and  •0"  denotes  that  both  events  occur. 


I 
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The  above  exp teas ion  reveals  the  important  role  that  min  cut  sets 
might  play,  when  calculation  is  feasible,  in  evaluating  the 
probability  of  occurence  of  the  top  node. 

If  it  is  assumed  that  each  basic  node  of  Figure  1  has  10~3  as  its 
probability  of  occurence,  and  most  importantly,  if  the  basic  node 
events  are  assumed  to  be  statistically  independent,  then  the 
I  computations  of  (1)  would  yield 

p|top  node  occurs}  as  2  x  10“3. 

As  a  general  principle,  it  is  to  be  noted  that  if  the  number  of  min 
cut  sets  in  a  fault  tree  is  g,  then  the  total  number  of  terms  in  the 
inclusion  exclusion-principle  calculation  is  2g  -  l;  thus,  for 
example,  if  q  »  20,  the  number  of  terms  in  the  calculation  is  about 
106.  The  magnitude  of  these  calculations  may  be  regarded  as  another 
difficulty  in  the  practical  implementation  of  FTA.  A  Monte  Carlo 
analysis  of  the  fault  tree  avoids  many  of  the  above  problems. 

In  addition  to  being  able,  in  small  problems,  to  calculate  the 
I  probability  of  occurence  of  the  top  node,  the  min  cut  sets  also  enable 

us,  in  such  problems,  to  compute  the  ‘availability*  of  the  system, 
such  as  an  aircraft  or  a  reactor,  and  the  importance  ranking  of  the 
various  basic  nodes.  Importance  ranking  in  the  context  of  EMP 
assessments  was  mentioned  above  as  point  4  in  connection  with  the 
usefulness  of  fault  trees. 

j  Various  computer  codes,  their  characteristics  and  limitations,  and 

their  sources  of  availability  for  calculating  the  probabilities  of 
occurence  of  the  basic  nodes  and  the  importance  measures  of  fault 
trees  are  described  in  the  literature.  This  information  should  prove 
useful  to  a  potential  user. 


APPLICATION  OF  FAULT  TREE  ANALYSIS  TO 
ELECTROMAGNETIC  PULSE  ASSESSMENTS 

It  appears  that  the  technique  of  fault  tree  analysis  is  potentially  a 
very  useful  tool  for  EMP  assessments  of  large  and  complex  systems. 
However,  there  are  some  difficulties  of  which  a  prospective  user 
should  be  aware.  These  difficulties  are  not  insurmountable;  but,  all 
the  same,  care  and  caution  are  necessary.  Specifically,  FTA  can  be 
used  for  the  following  tasks: 

1.  To  conduct  an  engineering  analysis  of  a  system  and  its 
hardening  with  respect  to  its  vulnerability  to  an  EMP  attack. 

2.  To  generate  a  numerical  measure,  via  a  probability  of  survival, 
of  the  vulnerability  of  a  system  and  its  hardening  with  respect 
to  a  previously  specified  EMP  attack  for  which  the 
probabilities  of  failure  of  individual  elements  can  be 
estimated  and  where  these  failures  are  reasonably  independent. 


3.  To  compare  and  contrast  several  competing  designs  and  schemes 
of  hardening  of  a  large  system,  which  is  vulnerable  to  an  EMP 
attack. 

4.  Given  that  a  system  cannot  be  completely  shielded  and  that  its 
components  and  subsystems  must  be  selectively  hardened,  to  help 
identify  and  rank  those  components  and  subsystems  in  terms  of 
the  degree  of  attention  that  they  need. 

5.  Given  the  vulnerability  or  the  hardening  capabilities  of  the 
components  and  subsystems  of  a  large  system,  to  enable  one  to 
evaluate  the  vulnerability  and  hardening  capabilities  of  the 
entire  system. 


Some  Difficulties  with  the  Application  of 
Fault  Tree  Analysis 

The  above  notes  of  optimism  should  be  tempered  with  the  following 
points  of  caution: 

1.  The  construction  of  a  fault  tree  for  EMP  assessment  calls  for 
much  skill  and  imagination  on  the  part  of  engineers  and 
designers  who  analyze  the  system.  One  has  to  anticipate 
unusual  circumstances  and  combinations  of  events  that  may  make 
a  system  vulnerable  to  an  EMP  attack.  Thus  patience  is  called 
for,  as  well  as  consultation  with  as  many  specialists  as  are 
necessary.  It  is  impossible  to  assure  that  a  particular  fault 
tree  is  a  satisfactory  description  of  the  system.  However,  as 
we  have  seen  throughout  this  report,  there  may  be  ways  of 
designing  the  system  to  reduce  the  chances  of  unexpected 
effects  and,  thereby,  to  make  the  system  more  assessable. 

2.  Hie  analysis  of  a  fault  tree  requires,  as  an  input,  the 
probabilities  of  occurence  of  the  basic  nodes.  (In  the  example 
of  Figure  1,  these  were  all  assumed  to  be  10“3.)  In  practice 
such  inputs  may  be  hard  to  come  by,  and  it  is  here  that 
subjective  notions  and  Bayesian  statistics  may  play  an 
essential  role.  The  latter  concepts,  of  course,  are  not 
without  much  criticism  and  debate.  However,  in  the  face  of 
reality  one  is  asked  to  make  EMP  assessments  and  decisions;  and 
one  may  not  have  much  choice  but  to  be  accommodating  to  expert 
and  subjective  inputs. 

3.  In  practice  it  is  frequently  assumed  that  the  basic  node  events 
are  independent — this  is  the  assumption  in  the  section  entitled 
■Calculating  the  Probability  of  Occurence  of  Any  Node  Fault." 

It  is  difficult  and  also  time  consuming  to  model  dependencies 
between  the  basic  node  events,  the  difficulties  increasing  with 
the  number  of  node  events  considered.  If  the  basic  node  events 
are  positively  correlated,  as  is  often  the  case  with  physical 
systems,  then  Uie  assumption  of  independence  yields  upper  or 
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lower  bounds  on  the  probabilities  of  occurence  of  the  various 
gate  nodes.  The  nature  of  these  bounds  depends  on  the  logic 
symbol  associated  with  each  gate,  and  in  practice  the  bounds 
may  be  too  wide  to  give  any  meaningful  insight  about  the 
probability  assessed.  In  Mastran  and  Singpurwalla  (1978)  the 
problem  of  component  dependencies  in  assessing  system 
reliability  is  addressed  and  should  prove  useful.  Much  more 
basic  research  needs  to  be  done  here. 

4.  A  final  difficulty  with  the  practical  implementation  of  fault 
trees  is  that  generated  by  the  computational  problems 
associated  with  large  trees.  This  difficulty  will  of  course 
diminish  with  the  new  generation  of  high  speed  computers. 


REFERENCES  FOR  APPENDIX  G 

Barlow,  R.  E.  1983.  Fault  Tree  Analysis.  Pp.  34-39  in  The 

Encyclopedia  of  Statistical  Sciences,  Vol.  3,  S.  Katz  and  N.  L. 
Johnson,  eds.  New  York:  John  Wiley  t  Sons. 

Barlow,  R.  E.,  J.  B.  Russell,  and  N.  D.  Singpurwalla,  eds.  1975. 
Reliability  and  Fault  Tree  Analysis.  Philadelphia:  Society  for 
Industrial  and  Applied  Mathematics. 

Fussell,  J.  B.  and  W.  E.  Vesely.  1972.  New  methodology  for  obtaining 
cut  sets  for  fault  trees.  Transactions  of  the  American  Nuclear 
Society  15:262-263. 

Mastran,  D.  V.  and  N.  D.  Singpurwalla.  1978.  A  Bayesian  estimation 
of  the  reliability  of  coherent  structures.  Operations  Research 
26:663-672. 

U.  S.  Nuclear  Regulatory  Commission.  1975.  Reactor  Safety  Study:  An 
Assessment  of  Accident  Risks  in  0.  S.  Commercial  Nuclear  Power 
Plants.  Washington  (NBC  Report  WASH-1400,  NUREG-75/014,  also  known 
as  the  ■Raomussen  rep*' :  t" ) .  October. 

Vesely,  W.  B.,  F.  ?.  Goldberg,  N.  B.  Roberts,  and  D.  F.  Baasl.  1981. 
Fault  Tree  Handbook.  Washington:  U,  S.  Nuclear  Regulatory 
Commission  (NUrEG-0432) . 

Worrell,  R.B.  1975.  Pp.  165-185  in  Reliability  and  Fault  Tree 
Analysis,  R.  E.  Barlow,  J.  B.  Fussell,  and  N.  D,  Singpurwalla, 
eds.  Philadelphia:  Society  for  Industrial  and  Applied  Mathematics. 


GLOSSARY 


AFWL:  Air  Force  Weapons  Laboratory. 
dS:  Decibels. 

DNA:  Defense  Nuclear  Agency. 

DOD:  0.  S.  Departnent  of  Defense 
EM:  Electromagnetic. 

EMP:  Electromagnetic  pulse. 

FT  A:  Fault  tree  analysis. 

GWEN:  Ground  Wave  Emergency  Network 

km:  Kilometers. 

kV:  Kilovolts. 

kv/m:  Kilovolts  per  meter. 

LPM:  Lumped  parameter  model. 

MeV:  Million  electron  volts. 

KHz:  Megahertz. 

MILSPSC:  Military  specification. 

POS:  Probability  of  survival. 

TRESTLE:  A  large-scale  electromagnetic  pulse  simulator  at  Air  Force 
Weapons  Laboratory,  Kirtland  Air  Force  Base,  New  Mexico 

VHSIC:  Very  high  speed  integrated  circuits. 

VLSI:  Very  large  scale  integration. 
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